# Generate grok custom pattern to message filed
**URL:** https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400
**Category:** Elasticsearch
**Created:** [June 17, 2020, 6:13am UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400 "2020-06-17T06:13:34Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 17, 2020, 6:13am UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/1 "2020-06-17T06:13:34Z")
Hi All, I am having a query related to grok processor.
For example this is my message filed
```
{
"message":"agentId:agent003"
}
```
I want to Grok this and my output should me something like this
```
{
"message":"agentId:agent003",
"agentId":"agent003"
}
```
Could some one help me on this how to achieve this? If i am able to do it for one field i can manage for rest of my fields. Thanks in advance.
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [June 17, 2020, 6:49am UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/2 "2020-06-17T06:49:30Z")
Try this:
`\"agentId:%{NOTSPACE:agentId}\"`
You can check at [https://grokconstructor.appspot.com/do/match](https://grokconstructor.appspot.com/do/match)
---
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 17, 2020, 10:50am UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/3 "2020-06-17T10:50:00Z")
Thanks a lot @fadjar340
---
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 17, 2020, 12:33pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/4 "2020-06-17T12:33:52Z")
Hi @fadjar340,
when i try to create a ingest pipeline using grok processor. Above mentioned grok pattern not accepted. Kindly advise.
```auto
PUT _ingest/pipeline/dissectpipeline
{
"description" : "split message content",
"processors": [
{
"grok": {
"field": "message",
"patterns": ["\"agentId:%{NOTSPACE:agentId}\""]
}
}
}
]
}
```
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [June 18, 2020, 5:53am UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/5 "2020-06-18T05:53:01Z")
If you use logstash, put the script in to the
```auto
filter {
grok {
match => { "message" => "\"agentId:%{NOTSPACE:agentId}\"}"
}
}
```
Regards,
Fadjar Tandabawana
---
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 18, 2020, 5:51pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/6 "2020-06-18T17:51:31Z")
Hi @fadjar340,
Thanks for reply but i configured everything in filebeat so i just wanted to create it as a ingest pipeline and have to use my pipeline Id in filebeat.
So while creating pipeline with the given grok pattern i am getting error. So could you please help me to achieve this in ingest pipeline methods as i have given my pipeline above.
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [June 18, 2020, 6:00pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/7 "2020-06-18T18:00:48Z")
> [@Mohan\_vel](#):
>
> ```auto
> PUT _ingest/pipeline/dissectpipeline
> {
> "description" : "split message content",
> "processors": [
> {
> "grok": {
> "field": "message",
> "patterns": ["\"agentId:%{NOTSPACE:agentId}\""]
> }
> }
> }
> ]
> }
>
> ```
There are unnecessary bracket that make an error
```auto
PUT _ingest/pipeline/dissectpipeline
{
"description" : "split message content",
"processors": [
{
"grok": {
"field": "message",
"patterns": ["\"agentId:%{NOTSPACE:agentId}\""]
}
}
} <= unnecessary
]
}
```
---
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 18, 2020, 6:09pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/8 "2020-06-18T18:09:02Z")
Oh God, simple, Wasted lot more time on this. 😂
Thanks @fadjar340
---
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 18, 2020, 6:12pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/9 "2020-06-18T18:12:40Z")
@fadjar340 - Also created another topic related to dissect pipeline added lnk for your reference that is something similar to this.
[multiple pattern dissect processor](https://discuss.elastic.co/t/how-to-create-multiple-pattern-dissect-processor-ingest-pipeline/237688)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 16, 2020, 6:12pm UTC](https://discuss.elastic.co/t/generate-grok-custom-pattern-to-message-filed/237400/10 "2020-07-16T18:12:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.