# Field data from match results
**URL:** https://discuss.elastic.co/t/field-data-from-match-results/80524
**Category:** Logstash
**Created:** [March 29, 2017, 5:05pm UTC](https://discuss.elastic.co/t/field-data-from-match-results/80524 "2017-03-29T17:05:12Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)
#### Post date: [March 29, 2017, 5:05pm UTC](https://discuss.elastic.co/t/field-data-from-match-results/80524/1 "2017-03-29T17:05:12Z")
I have following that matches incoming rabbit mq data,
match=\> { "full\_message" =\> "(?[^;]\*);[;]%{NUMBER:payloadSize};[;]%{GREEDYDATA:message\_text}" }
My requirement is to extract more fields out of the message text that i am retrieving, for ex, Tag1.Tag2.Tag3 might appear at the begining of the message\_text but they can be missing too..
Wondering what's the best way to take the message\_field and extract conditional information out of it
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 30, 2017, 6:01am UTC](https://discuss.elastic.co/t/field-data-from-match-results/80524/2 "2017-03-30T06:01:40Z")
It's hard to answer without knowing what the input messages look like.
Always format regular expressions (and other configuration) as preformatted text (there's a toolbar button for it). Your current expression has been mangled and isn't useful to us.
---
### Author:  [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)
#### Post date: [March 30, 2017, 5:08pm UTC](https://discuss.elastic.co/t/field-data-from-match-results/80524/3 "2017-03-30T17:08:22Z")
For my case input can appear in one of the two formats listed below. ( First case tags are present while for other case no tags are present and everything is considered part of message)
**Format 1 :**
`2017-03-30 09:37:13,705;INFO ;machinename.6028.1.5f80c274-38ad-469f-857f-74e55e1b70fc.1;2.1.1;0;; **Tag1.Tag2.Tag3** :31; OutArguments are: TransactionSuccess=True;
and other times
**Format 2**
`2017-03-30 09:37:13,743;INFO ;APANDE2-DESK8.6028.1.5f80c274-38ad-469f-857f-74e55e1b70fc.1;2.1.1;0;;calling logOutput for op Message data`
I have created a input message filter like following
`match=> { "full_message" => "(?[^;])[;](?[^;])[;]%{NUMBER:payloadSize};[;]%{GREEDYDATA:message_text}" }`
What i have been trying to achieve is retrieve tag1, tag2 and tag3 when they are present and ignore otherwise.
my approach was to use message\_text field created by match statement and then later use this field to retrieve tags (tag1, tag2, tag3) , i know there can be more than one way to achieve i am trying ,so other recommendations are welcome too.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 30, 2017, 7:17pm UTC](https://discuss.elastic.co/t/field-data-from-match-results/80524/4 "2017-03-30T19:17:39Z")
So log lines are CSV with either eight or nine column (if I counted them correctly). You could solve the problem with a csv filter and a conditional that checks if the current line had eight or nine fields, but if you want to stick to grok you could use e.g. `((?[^;]*);)?` to optionally match zero or more non-semicolon characters followed by a semicolon.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2017, 7:17pm UTC](https://discuss.elastic.co/t/field-data-from-match-results/80524/5 "2017-04-27T19:17:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.