# Cut off matching content and write to field
**URL:** https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197
**Category:** Logstash
**Created:** [August 2, 2022, 9:44am UTC](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197 "2022-08-02T09:44:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@anon90868141](https://discuss.elastic.co/u/anon90868141)
#### Post date: [August 2, 2022, 9:44am UTC](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197/1 "2022-08-02T09:44:40Z")
Hi,
is there any way to match a pattern inside a log and just write a port of it to a field? Here's a abstraction of my log:
elapsedTimeMs=41
I'd wrap it in () because it's sporadic and want the 41 to be written into a field called elapsed.time or so. Is there any way to do that?
Thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 2, 2022, 4:49pm UTC](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197/2 "2022-08-02T16:49:50Z")
Yes, you do that using a [grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) filter. Hard to say more without seeing some actual log lines rather than an abstraction.
---
### Author:  [@anon90868141](https://discuss.elastic.co/u/anon90868141)
#### Post date: [August 3, 2022, 6:20am UTC](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197/3 "2022-08-03T06:20:54Z")
`2022-08-03 08:13:54,376 INFO 1343434000 Server.Servlet [TraceID: 5bdd1e20] Operation completed {url="https://url", servletClass="edge.servlet.jsonrpc.JsonRpcServlet", executionTime=1530637574515724, from="1vvvv", user="11341444441000", elapsedTimeMs=301, message="lll servlet has stopped processing the request", eventType="STOP", serverID="abc-def-3434"}, Operation completed {url="https://ttttt", servletClass="edge.servlet.jsonrpc.JsonRpcServlet", executionTime=1530637574515724, from="12.34.56.78", user="1vvv0", elapsedTimeMs=301, message="u servlet has stopped processing the request", eventType="STOP", serverID="lxyz-def-213"}`
e.g. like that
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 3, 2022, 11:44am UTC](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197/4 "2022-08-03T11:44:02Z")
```auto
grok {
match => { "message" => "elapsedTimeMs=%{POSINT:elapsedtime}"
}
}
```
If you want to fully parse, use dissect or grok + KV for the content inside { .. }
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2022, 11:44am UTC](https://discuss.elastic.co/t/cut-off-matching-content-and-write-to-field/311197/5 "2022-08-31T11:44:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.