# Filter in grok - or \_

**URL:** https://discuss.elastic.co/t/filter-in-grok-or/154474
**Category:** Logstash
**Created:** [October 29, 2018, 5:00pm UTC](https://discuss.elastic.co/t/filter-in-grok-or/154474 "2018-10-29T17:00:27Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ldelpozo](https://avatars.discourse-cdn.com/v4/letter/l/977dab/32.png) [@ldelpozo](https://discuss.elastic.co/u/ldelpozo)
#### Post date: [October 29, 2018, 5:00pm UTC](https://discuss.elastic.co/t/filter-in-grok-or/154474/1 "2018-10-29T17:00:27Z")

</div>

Hello!!!

Is there a way to filter this in grok:

BMDL\_DEV/4.BMDL\_TEST\_HELLOWORLD\_DOCKER"

I am trying to break it in pieces but no luck

match =\> ["jenkins\_jobname", "(?\<jenkins\_jobnameenv\>.(\S\*._))(?\<\_\_forwardslash\>.(/+))%{NUMBER}.(?\<jenkins\_repo\>.(\S_))"]

i would like to form the following but no luck

BMDL  
\_ or -  
DEV  
/  
4  
.  
BMDL\_TEST\_HELLOWORLD\_DOCKER

Thank you for the help, I really appreciate it

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [October 30, 2018, 2:01pm UTC](https://discuss.elastic.co/t/filter-in-grok-or/154474/2 "2018-10-30T14:01:26Z")

</div>

I cleaned it up a little. I'm not sure how you wanted the result to look like (Did you really want to extract the slash? Does the name always contain BMDL and DEV? etc. ...). But maybe this can help.

`(?<jenkins_jobnameenv>\S*[-_]\S*)/+%{NUMBER}\.(?<jenkins_repo>\S*)`

```
{
  "jenkins_jobnameenv": [
    [
      "BMDL_DEV"
    ]
  ],
  "NUMBER": [
    [
      "4"
    ]
  ],
  "BASE10NUM": [
    [
      "4"
    ]
  ],
  "jenkins_repo": [
    [
      "BMDL_TEST_HELLOWORLD_DOCKER"
    ]
  ]
}
```

---

<div class="post-metadata">

### Author: ![ldelpozo](https://avatars.discourse-cdn.com/v4/letter/l/977dab/32.png) [@ldelpozo](https://discuss.elastic.co/u/ldelpozo)
#### Post date: [October 30, 2018, 2:10pm UTC](https://discuss.elastic.co/t/filter-in-grok-or/154474/3 "2018-10-30T14:10:38Z")

</div>

thank you!! 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 27, 2018, 2:10pm UTC](https://discuss.elastic.co/t/filter-in-grok-or/154474/4 "2018-11-27T14:10:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.