# ElasticSearch Grok Filter

**URL:** <https://discuss.elastic.co/t/elasticsearch-grok-filter/308295>\
**Category:** Elasticsearch\
**Created:** [June 27, 2022, 8:50pm UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295 "2022-06-27T20:50:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![HKN\_MZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkn_mz/32/75678_2.png) [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\
**Post date:** [June 27, 2022, 8:50pm UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295/1 "2022-06-27T20:50:58Z")

</div>

Hi Everyone, I try to apply grok filter for my logs. As you see I am getting some of them. But I don't get first.jobId=0 or first.applicationname=POLY2

How can I get these fields?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bf14525252d467fd01e874f9794f560960909609.png)

---

<div class="post-metadata">

**Author:** ![HKN\_MZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkn_mz/32/75678_2.png) [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\
**Post date:** [June 27, 2022, 9:23pm UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295/2 "2022-06-27T21:23:04Z")

</div>

Here is my log

> Blockquote  
> 2022-06-24 18:43:03,628 HM\_PROFILER INFO [lwolpert] [BBy7Twm70pt07CFfSPDjoCILcKsBJV3d7TkAyfWy] |firs.jobId=0|firs.applicationname=POLY2|firs.method=getExaminerScheduled|firs.class=gov.dhs.usss.pars.database.AgentDbUtil|firs.action=|firs.entity=|firs.entityAction=|firs.timeMetric=7|firs.applicationLayer=DATABASE|

---

<div class="post-metadata">

**Author:** ![sudhagar\_ramesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhagar_ramesh/32/105673_2.png) [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)\
**Post date:** [June 28, 2022, 2:50am UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295/3 "2022-06-28T02:50:21Z")

</div>

Hello @HKN_MZ

Try this below grok Pattern which would get jobid and appid

`%{DATESTAMP:Timestamp} %{WORD:application} %{WORD:log_type} \[%{WORD:user}\] \[%{WORD:id}\] \|%{DATA:jobid}\|%{DATA:appid}\|%{GREEDYDATA:unwanted}`

Keep Posted !!! Thanks !!! 😃

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 28, 2022, 5:50am UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295/4 "2022-06-28T05:50:04Z")

</div>

For this type of data I would recommend first separating out the string containing the key-value pairs using grok and then applying a [KV processor](https://www.elastic.co/guide/en/elasticsearch/reference/8.2/kv-processor.html). The KV processor will handle changes to the order of the keys and should be more efficient than grok here.

---

<div class="post-metadata">

**Author:** ![HKN\_MZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkn_mz/32/75678_2.png) [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\
**Post date:** [July 7, 2022, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295/5 "2022-07-07T11:10:03Z")

</div>

Thanks for your repplies,  
Here is the my way,

```auto
%{DATESTAMP:Timestamp} %{WORD:application} %{WORD:log.type} \[%{WORD:user}\] \[%{WORD:id}\] \|%{DATA:UNWANTED}\=%{USERNAME:firs.jobId}\|%{DATA:UNWANTED}\=%{USERNAME:firs.applicationname}\|%{DATA:UNWANTED}\=%{DATA:firs.method}\|%{DATA:UNWANTED}\=%{DATA:firs.class}\|%{DATA:UNWANTED}\=%{DATA:firs.action}\|%{DATA:UNWANTED}\=%{DATA:firs.entityAction}\|%{DATA:UNWANTED}\=%{USERNAME:firs.timeMetric}\|%{DATA:UNWANTED}\=%{USERNAME:firs.applicationLayer}

```

Output is here.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43afc52075c6e80d2668edec184c80d3a96bb86f.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2022, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-grok-filter/308295/6 "2022-08-04T11:10:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.