# Concatenate a word to an email using pre-defined grok filter

**URL:** <https://discuss.elastic.co/t/concatenate-a-word-to-an-email-using-pre-defined-grok-filter/130922>\
**Category:** Logstash\
**Created:** [May 8, 2018, 2:43am UTC](https://discuss.elastic.co/t/concatenate-a-word-to-an-email-using-pre-defined-grok-filter/130922 "2018-05-08T02:43:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![regex99](https://avatars.discourse-cdn.com/v4/letter/r/3da27b/32.png) [@regex99](https://discuss.elastic.co/u/regex99)\
**Post date:** [May 8, 2018, 2:43am UTC](https://discuss.elastic.co/t/concatenate-a-word-to-an-email-using-pre-defined-grok-filter/130922/1 "2018-05-08T02:43:16Z")

</div>

hi,  
first of all thank you for reading my question.  
i have an email address in a log in following format,

```
Apr 24 19:38:51 ip-10-0-1-204 sendmail[9489]: w3OJco1s009487: sendid:name@test.co.uk, delay=00:00:01, xdelay=00:00:01, mailer=smtp, pri=120318, relay=webmx.bglen.net. [10.0.3.231], dsn=2.0.0, stat=Sent (Ok: queued as E2DEF60724), w3OJco1s009487: to=<username@domain.us>, delay=00:00:01, xdelay=00:00:01, mailer=smtp, pri=120318, relay=webmx.[redacted].net. [10.0.3.231], dsn=2.0.0, stat=Sent (Ok: queued as E2DEF60724)

```

and i need to extract the email along with the word `sendid`

output should look like this,

```
{
  "DATA": [
    [
      "sendid:name@test.co.uk"
    ]
  ]
}

```

i have tried following but it only extracts email i tested it here, [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) ,

`sendid:%{DATA},`

How can i concatenate the word `sendid:` to the email without creating a new field or defining a new regex? can someone please help?

i have also tried this but it doesn't work,

sendid:%{"sendid:"} %{DATA},

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2018, 2:43am UTC](https://discuss.elastic.co/t/concatenate-a-word-to-an-email-using-pre-defined-grok-filter/130922/2 "2018-06-05T02:43:31Z")

</div>

Closed on June 5, 2018, 2:43am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.