# Filtering log message from Mulesoft app with grok

**URL:** <https://discuss.elastic.co/t/filtering-log-message-from-mulesoft-app-with-grok/220760>\
**Category:** Logstash\
**Created:** [February 25, 2020, 4:09am UTC](https://discuss.elastic.co/t/filtering-log-message-from-mulesoft-app-with-grok/220760 "2020-02-25T04:09:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aparasxidis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aparasxidis/32/46385_2.png) [@aparasxidis](https://discuss.elastic.co/u/aparasxidis)\
**Post date:** [February 25, 2020, 4:09am UTC](https://discuss.elastic.co/t/filtering-log-message-from-mulesoft-app-with-grok/220760/1 "2020-02-25T04:09:23Z")

</div>

Hi, I have the next message from a Mulesoft app  
"message": "event:1072eae0-5723-11ea-b982-0ad52e78f90f correlationId=ab7ab3a6-32b7-4529-872f-af0321c3f418"

I want to filter and get the "event" and "correlationId" in separate fields like this to be  
{  
"event": 1072eae0-5723-11ea-b982-0ad52e78f90f,  
"correlationId": ab7ab3a6-32b7-4529-872f-af0321c3f418  
}  
I know I can use grok, but how the grok pattern should look to be able to get these fields?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2020, 4:11am UTC](https://discuss.elastic.co/t/filtering-log-message-from-mulesoft-app-with-grok/220760/2 "2020-03-24T04:11:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.