# Converting Splunk Field Extraction in Logstash Equivalent

**URL:** <https://discuss.elastic.co/t/converting-splunk-field-extraction-in-logstash-equivalent/56504>\
**Category:** Logstash\
**Created:** [July 27, 2016, 10:56am UTC](https://discuss.elastic.co/t/converting-splunk-field-extraction-in-logstash-equivalent/56504 "2016-07-27T10:56:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![darioc](https://avatars.discourse-cdn.com/v4/letter/d/bb73d2/32.png) [@darioc](https://discuss.elastic.co/u/darioc)\
**Post date:** [July 27, 2016, 10:56am UTC](https://discuss.elastic.co/t/converting-splunk-field-extraction-in-logstash-equivalent/56504/1 "2016-07-27T10:56:04Z")

</div>

Hello,

I have the following field extraction in Splunk

(?i)- site:(?P\<site\_id\>[^;:]+)

How can I achieve a similar result with logstash?

Sample log message:

INFO 2016-07-21 13:17:48,139 [http-bio-8080-exec-5] com.vendor.recserver.controller.RestController - site:company; abtest:none; pagetemplate:PT\_RelatedRec: Total Time = 1ms. widget:RecentlyViewedProduct time:0ms scanned:0 timebox:none fallback:0 of 5 widget:RelatedRec time:0ms scanned:4 timebox:none fallback:0 of 4 context-url:[http://www.company.com/eu/p/347340](http://www.company.com/eu/p/347340)

Other similar splunk field extractions that I would like to replicate for the above message

(?i)context-(url|id):(?P\<rtx\_context\>[^$]+)  
(?i)Total Time = (?P\<rsp\_time\>\d+)

Again, is it possible to achieve a similar result using logstash and elastic search?

Thank you again in advance.

Haven't gotten very far with my logstash configuration

filter {  
date {  
match =\> ["logtime", "ISO8601"]  
}  
grok {  
match =\> { "message" =\> "%{LOGLEVEL:severity} %{TIMESTAMP\_ISO8601:logtime} %{NOTSPACE:javathread} %{JAVACLASS:class} %{GREEDYDATA:therest}"  
}  
}  
}

Ciao, Dario

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 27, 2016, 1:16pm UTC](https://discuss.elastic.co/t/converting-splunk-field-extraction-in-logstash-equivalent/56504/2 "2016-07-27T13:16:59Z")

</div>

You shouldn't assume that people here know Splunk, i.e. asking "how do I do $SPLUNK\_THING in Logstash" might not give the best answers.

> ```
> (?i)- site\:(?P[^;:]+)
> 
> ```

Did you actually mean to say

```
(?i)- site\:(?<site>P[^;:]+)

```

or similar? Or what's the "P" doing there? I would've used

```
- site:(?<site>[^;]+)

```

to match and extract the site name in your example into a field named `site`. Notes:

- There's no need to escape the colon since it isn't a meta-character in regular expressions.
- I'm not sure why you included a colon in the negative character class so I omitted it.
- I'm not sure if `(?ì)` indeed does enable case-insensitive matches, but I'd assume that the log always says "site:" and never "Site:" or "SITE:".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/converting-splunk-field-extraction-in-logstash-equivalent/56504/3 "2017-07-06T04:46:20Z")

</div>

Closed on July 6, 2017, 4:46am UTC