# Extract number from a text in kibana

**URL:** <https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605>\
**Category:** Kibana\
**Created:** [April 5, 2022, 8:57am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605 "2022-04-05T08:57:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roberto\_Mejri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roberto_mejri/32/103719_2.png) [@Roberto\_Mejri](https://discuss.elastic.co/u/Roberto_Mejri)\
**Post date:** [April 5, 2022, 8:57am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605/1 "2022-04-05T08:57:18Z")

</div>

Hi, I need to extract a number from these text and then get the result if the value is greater than 1 or lesser than 1, can somebody knows how to do that?  
I show in the picture whitch filters I use to get the message, I tried to do the substring how shown online but it didn't work

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44a769b7cd3d80dbc9ff990f20bae362181925cf.png)

---

<div class="post-metadata">

**Author:** ![S-elk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s-elk/32/98464_2.png) [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Post date:** [April 5, 2022, 9:09am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605/2 "2022-04-05T09:09:04Z")

</div>

hello.

I think you should assign that number to an independent field. Then yo can do what you want using conditionals in logstash or apply a filter directly from kibana.

---

<div class="post-metadata">

**Author:** ![Roberto\_Mejri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roberto_mejri/32/103719_2.png) [@Roberto\_Mejri](https://discuss.elastic.co/u/Roberto_Mejri)\
**Post date:** [April 5, 2022, 9:10am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605/3 "2022-04-05T09:10:44Z")

</div>

I have other logs with different parameters and I don't wanna break everything, do you know how may I create a field just using this source e message?

---

<div class="post-metadata">

**Author:** ![S-elk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s-elk/32/98464_2.png) [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Post date:** [April 5, 2022, 9:18am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605/4 "2022-04-05T09:18:30Z")

</div>

with logstash you can split the message field into multiple fields keeping the message field.

For example with a Grok filter

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/4/147c1bf9ce2e9a90e19b95d09335089155579e33.png)

in logstash :

```auto
filter {
      grok {
        match => { "message" => "%{DATA}: %{NUMBER:NumeroExtraido}" }
      }
}

```

once parsed, this value will be recorded in a new NumeroExtraido field that you can use for filtering in kibana or extra enrichment for those records where this value is bigger or smaller than 1 for example.

---

<div class="post-metadata">

**Author:** ![Roberto\_Mejri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roberto_mejri/32/103719_2.png) [@Roberto\_Mejri](https://discuss.elastic.co/u/Roberto_Mejri)\
**Post date:** [April 5, 2022, 9:41am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605/5 "2022-04-05T09:41:25Z")

</div>

thanks, I will try this, I ve seen online that I can set the grok in devTools but the problem is I can't find it in my menu  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70ba1ab498d627940bd81456be778ef09b617776.png)

---

<div class="post-metadata">

**Author:** ![S-elk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s-elk/32/98464_2.png) [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Post date:** [April 5, 2022, 9:47am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605/6 "2022-04-05T09:47:57Z")

</div>

i dont know wich kibana version are you using. In new versions it appears in stack management \> Dev Tools \> Grok debugger

But it is only a tester to check your Grok Pattern.

![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d192ad468363b7e4c06e6b0a97e953301b8fc11.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2022, 9:48am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605/7 "2022-05-03T09:48:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.