# Extracting values from log body **URL:** \ **Category:** Logstash\ **Created:** [April 29, 2016, 8:35am UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781 "2016-04-29T08:35:07Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [April 29, 2016, 8:35am UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/1 "2016-04-29T08:35:08Z")
Hi there, Suppose I am getting a log message through logstash, with some custom format of the form `FIELD1=VALUE1` etc. I am still quite a bit in the dark here, but I've been playing a little with visualizations. What I would like to do is obtain a unique count of, say, values of `FIELD1`. I think this is called an aggregation what I'm trying to do. My question is: do I _need_ to grok these fields at the logstash stage, and put all values in separate fields? Or can the field be parsed at search-time, Splunk-style? Or is there another recommended solution? I'm looking for "the ELK way" here. Thanks for your thoughts. Dan ---
**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\ **Post date:** [May 2, 2016, 9:34am UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/2 "2016-05-02T09:34:50Z")
Hi Dan, I've moved your question to the Logstash forum as it seems to be the more appropriate place for this question. Daniel ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [May 2, 2016, 10:02am UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/3 "2016-05-02T10:02:57Z")
Hi Daniel, and thanks. I honestly wouldn't know, hopefully it will get answered there. ---
**Author:** ![purbon](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@purbon](https://discuss.elastic.co/u/purbon)\ **Post date:** [May 2, 2016, 2:29pm UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/4 "2016-05-02T14:29:11Z")
Hi, If I understand your use case properly, I would try the kv filter, it seems the most suited to answer your needs here. [https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) - purbon ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [May 3, 2016, 12:20pm UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/5 "2016-05-03T12:20:38Z")
Hi Pere, and thanks for the answer. It doesn't really address my question though. I am using `kv`, of course. The question is, do I need it? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 3, 2016, 12:23pm UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/6 "2016-05-03T12:23:07Z")
The fields need to be extracted at index time in order for them to be available for aggregations in Kibana. ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [May 3, 2016, 12:24pm UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/7 "2016-05-03T12:24:15Z")
Thanks Christian! This answers my question. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/extracting-values-from-log-body/48781/8 "2017-07-06T04:59:33Z")