# Filtering using grok

**URL:** <https://discuss.elastic.co/t/filtering-using-grok/51327>\
**Category:** Logstash\
**Created:** [May 30, 2016, 1:32pm UTC](https://discuss.elastic.co/t/filtering-using-grok/51327 "2016-05-30T13:32:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![GINS007](https://avatars.discourse-cdn.com/v4/letter/g/f475e1/32.png) [@GINS007](https://discuss.elastic.co/u/GINS007)\
**Post date:** [May 30, 2016, 1:32pm UTC](https://discuss.elastic.co/t/filtering-using-grok/51327/1 "2016-05-30T13:32:45Z")

</div>

Hi,

I want to perform different operation based on the entry in my log file.

2016-05-12 18:32:11,452 [http-8080-2] INFO AwsLifeCycleManager Aws VMProvisioning **SUCCESS** AssetID IP AssetName

If the operation is FAILED instead of SUCCESS then the log entry will be

2016-05-12 18:32:11,452 [http-8080-2] INFO AwsLifeCycleManager Aws VMProvisioning **FAILED** ERROR MESSAGE

Please help me to filter this logfile based on SUCCESS/FAILED using grok, so that I can list the successful operations and failed operations separately.

Thanks in advance .

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 31, 2016, 1:04am UTC](https://discuss.elastic.co/t/filtering-using-grok/51327/2 "2016-05-31T01:04:36Z")

</div>

First up you need a grok pattern, try [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) for assistance on that.  
Once you have the status field defined you can do the next step you're after.

---

<div class="post-metadata">

**Author:** ![GINS007](https://avatars.discourse-cdn.com/v4/letter/g/f475e1/32.png) [@GINS007](https://discuss.elastic.co/u/GINS007)\
**Post date:** [May 31, 2016, 5:40am UTC](https://discuss.elastic.co/t/filtering-using-grok/51327/3 "2016-05-31T05:40:00Z")

</div>

Thanks Mark ,

I have already created a grok pattern for matching the log statements,  
grok {  
match =\> {"message" =\> "(?%{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}) %{TIME:time} (?[\w{4}-\d{1,}-\d{1,}]) %{WORD:info} %{WORD:cls} %{WORD:provider} %{WORD:method} %{WORD:result} "}  
if [result] == "FAILED" {  
match =\> {"message" =\> " %{WORD:ERROR} %{GREEDYDATA:message}" }  
}  
else {  
match =\> {"message" =\> " %{WORD:asset} %{IP:hostip} %{GREEDYDATA:privatename}" }  
}  
}

Could you Please tell me what is wrong in this condition statement

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 31, 2016, 7:44am UTC](https://discuss.elastic.co/t/filtering-using-grok/51327/4 "2016-05-31T07:44:19Z")

</div>

You can't have a conditional inside a grok filter. I suggest you use two grok expressions that Logstash will try in order:

```nohighlight
grok {
  match => {
    "message" => [
      "(?%{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}) %{TIME:time} (?[\w{4}-\d{1,}-\d{1,}]) %{WORD:info} %{WORD:cls} %{WORD:provider} %{WORD:method} (?<result>SUCCESS) %{WORD:asset} %{IP:hostip} %{GREEDYDATA:privatename}",
      "(?%{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}) %{TIME:time} (?[\w{4}-\d{1,}-\d{1,}]) %{WORD:info} %{WORD:cls} %{WORD:provider} %{WORD:method} (?<result>FAILED) %{WORD:ERROR} %{GREEDYDATA:message}"
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![GINS007](https://avatars.discourse-cdn.com/v4/letter/g/f475e1/32.png) [@GINS007](https://discuss.elastic.co/u/GINS007)\
**Post date:** [May 31, 2016, 9:09am UTC](https://discuss.elastic.co/t/filtering-using-grok/51327/5 "2016-05-31T09:09:06Z")

</div>

Thanks Magnus,  
It worked 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/filtering-using-grok/51327/6 "2017-07-06T04:55:21Z")

</div>