# Creating a sub field of GROK filter pattern **URL:** https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860 **Category:** Logstash **Created:** [June 26, 2020, 12:51pm UTC](https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860 "2020-06-26T12:51:39Z") **Posts on this page:** 6 **Page:** 1
### Author: ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472) #### Post date: [June 26, 2020, 12:51pm UTC](https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860/1 "2020-06-26T12:51:39Z")
Hi Everyone, i have a logstash configuration to parse my current logs but i would like to create a sub field from my message field and that data should be parsed as a fieldname, please suggest how that is possible: For example in the following logs how can i make a separate field for PosErr\_Advancing ```auto Oct 10 09:05:29 ff303-srv1 MC: ERROR {33417} [RDSA] Lim='PosErr_Advancing' IsPosition=5.964 SetPosition=nan IsSpeed=-44098.585 IsAcceleration=-11024646.148 Load=-1.647 TriggerDelay=0.000s SpeedLim=0.000% Ramp=5.000m/s2 SafeState=JobDeactivated ResetDelay=1.000s BrakeInstantly=N AffectSa(truncated) ``` my current log pattern looks like this 🙂 ```auto grok { match => {"message" => '(?[\w\s\d\:]+)\s(?[\w\d]+)\-(?[\w\d]+)\s(?[\w\:]+)\s(?[\w\s\{\d\}]+)\s(?[\w\s\w\=\"\d\:\s\"\?\'\/\.\-\,\{\}\[\]\(\)]+)' } }} ``` ---
### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger) #### Post date: [July 12, 2020, 11:42pm UTC](https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860/2 "2020-07-12T23:42:40Z")
Personally I would not grok that, I would [dissect and then use kv](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786/2). ---
### Author: ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472) #### Post date: [July 29, 2020, 2:52pm UTC](https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860/3 "2020-07-29T14:52:26Z")
Hi @Badger thanks and i used the dissect and kv for this but at some places in log files because of a space timestamp is read into the next field, i will add my config and log files below, please check and suggest how i can read spaces if it appears sometimes: Config ```auto filter { dissect { mapping => { "message" => "%{timestamp1} %{+timestamp1} %{+timestamp1} %{Theatre} %{Product} %{Severity} %{Body}" "Body" => "%{1} %{2} %{3} %{4} %{5} %{6} %{7}" } } kv { source => "Body" } } output { elasticsearch { hosts => ["http://localhost:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } ``` and the log data is like below : ```auto Jul 8 05:01:07 ff302-srv1 MC: debug {0} [Equip] Adding equipment="gio" Id=1 Jul 8 05:01:07 ff302-srv1 MC: debug {0} [Equip] Adding equipment="rev" Id=2 ``` sometime there is log data where i have some space within timestamp and at that time date is being read in the theatre field instead of timestamp, please check and share your views on this ---
### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger) #### Post date: [July 29, 2020, 4:55pm UTC](https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860/4 "2020-07-29T16:55:28Z")
If the problem is the extra space between Jul and 8 then change the mapping from ```auto "%{timestamp1} %{+timestamp1} %{+timestamp1} %{Theatre}... ``` to ```auto "%{timestamp1->} %{+timestamp1} %{+timestamp1} %{Theatre}... ``` ---
### Author: ![hemant\_472](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@hemant\_472](https://discuss.elastic.co/u/hemant_472) #### Post date: [July 29, 2020, 6:52pm UTC](https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860/5 "2020-07-29T18:52:00Z")
thanks @Badger it worked 😀 ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [August 26, 2020, 6:52pm UTC](https://discuss.elastic.co/t/creating-a-sub-field-of-grok-filter-pattern/238860/6 "2020-08-26T18:52:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.