# Exclude ordered list numbers while parsing

**URL:** https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593
**Category:** Logstash
**Created:** [May 17, 2019, 12:30pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593 "2019-05-17T12:30:32Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Abhilash\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhilash_b/32/40270_2.png) [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)
#### Post date: [May 17, 2019, 12:30pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593/1 "2019-05-17T12:30:32Z")

</div>

Hi all,

I have `1. StartTime:3761976079` to be parsed, it may have leading and trailing spaces. I am using this grok expression to parse `^(?<key>[^:]+):\s*%{GREEDYDATA:value}`. How do I exclude the number at the start? Current output `"1. StartTime":"3761976079"`, Expected output `"StartTime":"3761976079"`.

Any help is appreciated. Thanks

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [May 17, 2019, 12:39pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593/2 "2019-05-17T12:39:17Z")

</div>

> [@Abhilash\_B](#):
>
> (?[^:]+):\s\*%{GREEDYDATA:value}

INPUT: 1. StartTime:3761976079  
OUTPUT:  
{  
"StartTime": "3761976079"  
}

GROK:  
\[1\]{1,}[.] StartTime:%{GREEDYDATA:StartTime}$  
or  
\[2\]{1,}. StartTime:%{GREEDYDATA:StartTime}$

* * *

1. 0-9 

2. 0-9

---

<div class="post-metadata">

### Author: ![Abhilash\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhilash_b/32/40270_2.png) [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)
#### Post date: [May 17, 2019, 12:41pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593/3 "2019-05-17T12:41:15Z")

</div>

> [@pastechecker](#):
>
> GROK:  
> \[1\]{1,}[.] StartTime:%{GREEDYDATA:StartTime}$

The key can be dynamic, hence I need to extract the "key" separately.

* * *

1. 0-9

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [May 17, 2019, 12:42pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593/4 "2019-05-17T12:42:04Z")

</div>

So you want it to be:  
{  
"key":"1",  
"StartTime": "3761976079"  
}

?

---

<div class="post-metadata">

### Author: ![Abhilash\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhilash_b/32/40270_2.png) [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)
#### Post date: [May 17, 2019, 12:43pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593/5 "2019-05-17T12:43:28Z")

</div>

> [@pastechecker](#):
>
> So you want it to be:  
> {  
> "key":"1",  
> "StartTime": "3761976079"  
> }

No,  
{  
"key":"StartTime",  
"value":"3761976079"  
}

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [May 17, 2019, 12:48pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593/6 "2019-05-17T12:48:25Z")

</div>

Try that:

1. StartTime:3761976079
2. Helloworld:3761976079

^[0-9]{1,}.\s%{DATA:key}:%{GREEDYDATA:value}$

{  
"value": "3761976079",  
"key": "StartTime"  
}  
{  
"value": "3761976079",  
"key": "Helloworld"  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2019, 12:48pm UTC](https://discuss.elastic.co/t/exclude-ordered-list-numbers-while-parsing/181593/7 "2019-06-14T12:48:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.