# Extract word from field
**URL:** https://discuss.elastic.co/t/extract-word-from-field/125598
**Category:** Logstash
**Created:** [March 26, 2018, 12:35pm UTC](https://discuss.elastic.co/t/extract-word-from-field/125598 "2018-03-26T12:35:28Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Majuan](https://discuss.elastic.co/u/Majuan)
#### Post date: [March 26, 2018, 12:35pm UTC](https://discuss.elastic.co/t/extract-word-from-field/125598/1 "2018-03-26T12:35:28Z")
I have Apache logs to index, but i would like to extract more information after groking the logs. One log line is like this :
\ 10.23.252.66 - - [26/Mar/2018:01:54:40 +0200] "GET /AppName/services/rest/supervision/supervise HTTP/1.1" 200 2026 "-" "check\_http/v2.2.1 (nagios-plugins 2.2.1)" \
I use this grok pattern and it's working :
\ grok {
match =\> [
"message", "%{COMMONAPACHELOG}( (?:%{QS:referrer}) (?:%{QS:agent}))?"
]
}
But i want to extract the AppName from the field %{request}. How to do it?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 26, 2018, 6:12pm UTC](https://discuss.elastic.co/t/extract-word-from-field/125598/2 "2018-03-26T18:12:22Z")
Use a second grok filter to parse the field that contains the request. If the application name is always the first directory component you can use `^/(?[^/]+)/` as the grok expression in that filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 23, 2018, 6:13pm UTC](https://discuss.elastic.co/t/extract-word-from-field/125598/3 "2018-04-23T18:13:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.