# Filter logs using logstash
**URL:** https://discuss.elastic.co/t/filter-logs-using-logstash/170459
**Category:** Logstash
**Created:** [March 1, 2019, 8:47am UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459 "2019-03-01T08:47:07Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Costi](https://discuss.elastic.co/u/Costi)
#### Post date: [March 1, 2019, 8:47am UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/1 "2019-03-01T08:47:07Z")
Hi!
I am using logstash to ingest some data from a sql DB. I am able to get the data in elastic but i want to get a substring from a filed and put it into another field. For example i have the following line:
{"Timestamp":"2018-10-17T10:36:26.1895556+03:00","Level":"Information","MessageTemplate":"MessageBusSubscriberService for message type {MessageType} is starting","Properties":{"MessageType":"ResetCache","SourceContext":"adjadsklaslk","CorrelationId":null}}
I want to get "Reset Cache" which is after "Message Type" and to put it in another field.
I tried with grok or mutate filter but i wasn't able to get that substring. Do you have any solution?
Thanks a lot!
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [March 1, 2019, 10:48am UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/2 "2019-03-01T10:48:17Z")
> [@Costi](#):
>
> {"MessageType":"ResetCache","SourceContext":"adjadsklaslk","CorrelationId":null}}
> I want to get "Reset Cache" which is after "Message Type" and to put it in another field.
Can you try this pattern and please find my result below
MessageType":"?(?[a-zA-Z]+)
Result
{
"MessageType": [
[
"ResetCache"
]
]
}
---
### Author:  [@Costi](https://discuss.elastic.co/u/Costi)
#### Post date: [March 1, 2019, 11:38am UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/3 "2019-03-01T11:38:51Z")
Hi!
Thanks for your reply! One more question: Which filter do i have to use for the pattern that you provide?
Thanks!
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [March 1, 2019, 11:44am UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/4 "2019-03-01T11:44:43Z")
> [@Costi](#):
>
> Which filter do i have to use for the pattern that you provide?
grok{
match =\> {"message" =\> "MessageType":"?(?[a-zA-Z]+)"}
}
---
### Author:  [@Costi](https://discuss.elastic.co/u/Costi)
#### Post date: [March 1, 2019, 12:12pm UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/5 "2019-03-01T12:12:40Z")
I have the folloowing filter section:
filter {
grok {
match =\> {"logevent" =\> "MessageType":"?(?[a-zA-Z]+)"}
}
}
and when i run logstash i get the following error:
Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 16, column 40 (byte 522) after filter
I don'e see where is missing one of #, {, }.
Thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 1, 2019, 12:52pm UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/6 "2019-03-01T12:52:58Z")
```
"MessageType":"?(?[a-zA-Z]+)"
```
If you are trying to match " in a field then either use ' or \" in the configuration
```
match => { "logevent" => '"MessageType":"?(?[a-zA-Z]+)"' }
```
---
### Author:  [@Costi](https://discuss.elastic.co/u/Costi)
#### Post date: [March 1, 2019, 1:21pm UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/7 "2019-03-01T13:21:57Z")
Even if i use ' i still get an error:
exception=\>"NoMethodError", :message=\>"undefined method `unlock' for nil:NilClass"
Do you have any idea? Or is the pattern wrong?
Thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 1, 2019, 1:30pm UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/8 "2019-03-01T13:30:16Z")
The pattern is wrong because the markdown ate the field name
```
match => {"message" => 'MessageType":"?(?[a-zA-Z]+)'}
```
However, if you are still getting "undefined method `unlock' for nil:NilClass" please provide the entire filter, becausei I would not expect to get that error from a grok.
Have you considered using a json filter?
```
json { source => "someColumn" }
```
---
### Author:  [@Costi](https://discuss.elastic.co/u/Costi)
#### Post date: [March 1, 2019, 1:36pm UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/9 "2019-03-01T13:36:03Z")
Worked! Thanks a lot
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2019, 1:36pm UTC](https://discuss.elastic.co/t/filter-logs-using-logstash/170459/10 "2019-03-29T13:36:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.