# Extracting data from message

**URL:** https://discuss.elastic.co/t/extracting-data-from-message/136602
**Category:** Logstash
**Created:** [June 20, 2018, 4:14am UTC](https://discuss.elastic.co/t/extracting-data-from-message/136602 "2018-06-20T04:14:36Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![srimaheswari\_chowdar](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@srimaheswari\_chowdar](https://discuss.elastic.co/u/srimaheswari_chowdar)
#### Post date: [June 20, 2018, 4:14am UTC](https://discuss.elastic.co/t/extracting-data-from-message/136602/1 "2018-06-20T04:14:36Z")

</div>

Hi,

I used grok and geo IP filter to extract the data fields from the message but I am unable to do. So, I even used disscent filter as all my logs have the same pattern I found no luck. How can I achieve this task? Please advice.

MY LOG:  
2017-02-14T23:55:29.784176Z LCPROD-APACHE xxx.x6.x8.x6:xxx737 xxx.xx.xx.xx:443 0.000047 0.001386 0.000022 301 301 368 350 "POST [https://xxx.com:443/autodiscover/autodiscover.xml](https://xxx.com:443/autodiscover/autodiscover.xml) HTTP/1.1" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7151; Pro)" xxxx-RSA-xxx128-SHA TLSv1

dissect {  
mapping =\> {  
message =\> "{request\_timestamp} %{elb\_name} %{request\_ip} %{request\_port} %{backend\_ip},%{backend\_port},%{request\_processing\_time},%{backend\_processing\_time},%{client\_response\_time},%{elb\_response\_code},%{backend\_response\_code},%{received\_bytes},%{sent\_bytes},%{request\_verb},%{url},%{protocol},%{user\_agent},%{ssl\_cipher},%{ssl\_protocol}"  
}

Thanks  
Maheswari

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 20, 2018, 5:15pm UTC](https://discuss.elastic.co/t/extracting-data-from-message/136602/2 "2018-06-20T17:15:00Z")

</div>

Your fields are not comma separated, so do not use commas in your dissect mapping, use spaces, or colons, or double quotes or whatever the delimiters in your message are

```
    mapping => {
        message => '%{request_timestamp} %{elb_name} %{request_ip}:%{request_port} %{backend_ip}:%{backend_port} %{request_processing_time} %{backend_processing_time} %{client_response_time} %{elb_response_code} %{backend_response_code} %{received_bytes} %{sent_bytes} "%{request_verb} %{url} %{protocol}" "%{user_agent}" %{ssl_cipher} %{ssl_protocol}'
    }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2018, 5:15pm UTC](https://discuss.elastic.co/t/extracting-data-from-message/136602/3 "2018-07-18T17:15:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.