# Extracting a field further after its been parsed by Grok Filter

**URL:** <https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883>\
**Category:** Logstash\
**Created:** [March 20, 2021, 11:16am UTC](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883 "2021-03-20T11:16:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmoss25](https://avatars.discourse-cdn.com/v4/letter/r/b4bc9f/32.png) [@rmoss25](https://discuss.elastic.co/u/rmoss25)\
**Post date:** [March 20, 2021, 11:16am UTC](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883/1 "2021-03-20T11:16:42Z")

</div>

HI,  
Is there a way to parse a field further after its already been parsed by grok? So after I parse out DN from the main message, I now want to parse DN further as it contains a username. So I want to parse out test.Test as a username after it already been parsed as DN.

 ![Screen Shot 2021-03-20 at 7.20.27 AM](https://us1.discourse-cdn.com/elastic/original/3X/7/4/746d0422c1de2f75a223688db3a7801d809cefbb.png)

```auto
12-MAR-21 00:43:38|158.98.214.94|15|CN=Test.Test,OU=alpha Users,OU=alpha,OU=Business Units,DC=alphadev,DC=dev,DC=abc,DC=ca|foJ16BD1/B42LI5Cfke/D4oDcUA=|TEST"

```

```auto
filter {
    grok {
             match => { "message" => ["%{GREEDYDATA:timestamp}\|%{IPV4:src_ip}\|%{WORD:event_id}\|%{GREEDYDATA:DN}\|%{NOTSPACE:session}\|%{WORD:application}"] }
    remove_field => ["message"]
    grok
           }
           }

```

---

<div class="post-metadata">

**Author:** ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)\
**Post date:** [March 20, 2021, 12:22pm UTC](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883/2 "2021-03-20T12:22:46Z")

</div>

After the grok filter has applied the extracted fields are available for the next filters. So you could apply another grok after the first one.

---

<div class="post-metadata">

**Author:** ![rmoss25](https://avatars.discourse-cdn.com/v4/letter/r/b4bc9f/32.png) [@rmoss25](https://discuss.elastic.co/u/rmoss25)\
**Post date:** [March 21, 2021, 12:12pm UTC](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883/3 "2021-03-21T12:12:13Z")

</div>

Thanks,  
I have tried to add the extra grok but I cant get logstash to start without errors on the syntax. Is it as simple as the below?

```auto
filter {
grok {
         match => { "message" => ["%{GREEDYDATA:timestamp}\|%{IPV4:src_ip}\|%{WORD:event_id}\|%{GREEDYDATA:DN}\|%{NOTSPACE:session}\|%{WORD:application}"] }
grok
       {
        match => { "DN" => [\w+\=%{WORD:User}] }
       }
{
remove_field => ["message"]

       }
       }

```

---

<div class="post-metadata">

**Author:** ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)\
**Post date:** [March 21, 2021, 12:44pm UTC](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883/4 "2021-03-21T12:44:48Z")

</div>

Your first Grok has no closing bracket.  
Thatswhy Logstash is not starting.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2021, 12:44pm UTC](https://discuss.elastic.co/t/extracting-a-field-further-after-its-been-parsed-by-grok-filter/267883/5 "2021-04-18T12:44:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.