# Filter Data With First Data in grok filter

**URL:** <https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426>\
**Category:** Logstash\
**Created:** [October 14, 2019, 10:03am UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426 "2019-10-14T10:03:56Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![kisuke](https://avatars.discourse-cdn.com/v4/letter/k/839c29/32.png) [@kisuke](https://discuss.elastic.co/u/kisuke)\
**Post date:** [October 14, 2019, 10:03am UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/1 "2019-10-14T10:03:56Z")

</div>

All is in the title I want to filter with the first data in my grok filter to use an other grok filter

---

<div class="post-metadata">

**Author:** ![Bouraoui\_Kacem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bouraoui_kacem/32/44744_2.png) [@Bouraoui\_Kacem](https://discuss.elastic.co/u/Bouraoui_Kacem)\
**Post date:** [October 14, 2019, 10:08am UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/2 "2019-10-14T10:08:26Z")

</div>

Can you explain us the problem with example please ?

---

<div class="post-metadata">

**Author:** ![kisuke](https://avatars.discourse-cdn.com/v4/letter/k/839c29/32.png) [@kisuke](https://discuss.elastic.co/u/kisuke)\
**Post date:** [October 14, 2019, 10:22am UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/3 "2019-10-14T10:22:53Z")

</div>

For example I have something like this to parse :

"Application data 12.25.56.32 on like"

The problem that I have is that the data hasn't the same format everytime, sometimes it will be something like this :

"Application 10.12.14.15 12.12.12.12 word word word word"

So I wanted to know if we can just get the first data (the field Application in my example) to create some conditions (some if in the .conf file) to filter following the application that we get

---

<div class="post-metadata">

**Author:** ![kisuke](https://avatars.discourse-cdn.com/v4/letter/k/839c29/32.png) [@kisuke](https://discuss.elastic.co/u/kisuke)\
**Post date:** [October 16, 2019, 12:01pm UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/4 "2019-10-16T12:01:36Z")

</div>

upup

---

<div class="post-metadata">

**Author:** ![kisuke](https://avatars.discourse-cdn.com/v4/letter/k/839c29/32.png) [@kisuke](https://discuss.elastic.co/u/kisuke)\
**Post date:** [October 23, 2019, 8:56am UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/5 "2019-10-23T08:56:41Z")

</div>

Searching alone

---

<div class="post-metadata">

**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\
**Post date:** [October 23, 2019, 6:57pm UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/6 "2019-10-23T18:57:39Z")

</div>

Can you add your answer? Then others having the same problem can learn from it as well 🙂

---

<div class="post-metadata">

**Author:** ![kisuke](https://avatars.discourse-cdn.com/v4/letter/k/839c29/32.png) [@kisuke](https://discuss.elastic.co/u/kisuke)\
**Post date:** [October 25, 2019, 11:35am UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/7 "2019-10-25T11:35:32Z")

</div>

it's written in my last message, you can close it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2019, 11:35am UTC](https://discuss.elastic.co/t/filter-data-with-first-data-in-grok-filter/203426/8 "2019-11-22T11:35:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.