# Grok extract field problem

**URL:** <https://discuss.elastic.co/t/grok-extract-field-problem/159636>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 6, 2018, 2:45am UTC](https://discuss.elastic.co/t/grok-extract-field-problem/159636 "2018-12-06T02:45:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ferdina](https://avatars.discourse-cdn.com/v4/letter/f/8491ac/32.png) [@ferdina](https://discuss.elastic.co/u/ferdina)\
**Post date:** [December 6, 2018, 2:45am UTC](https://discuss.elastic.co/t/grok-extract-field-problem/159636/1 "2018-12-06T02:45:30Z")

</div>

I have a problem in the production process  
Version es 651 filebeat 651  
Modify the nginx template to extract the cookies from the nginx log

"grok": {  
"field": "message",  
"patterns":[  
""?%{IPV4:nginx.access.remote\_ip\_list} - %{DATA:nginx.access.user\_name} \[%{HTTPDATE:nginx.access.time}\] "%{GREEDYDATA:nginx.access .info}" %{NUMBER:nginx.access.response\_code} %{NUMBER:nginx.access.body\_sent.bytes} "%{DATA:nginx.access.referrer}" "%{DATA:nginx.access .agent}" "%{DATA:nginx.access.cookie}" "%{DATA:nginx.access.request\_body}""

Then extract the email address in the cookie field

"grok": {  
"field": "nginx.access.cookie",  
"patterns": [  
"email=%{EMAILADDRESS:nginx.access.client}",  
""  
],  
"ignore\_missing": true

But found that when the cookie field format is as follows

[Email=cloris@ucan.com](mailto:Email=cloris@ucan.com); token=ecc47f17abc040928c3c89c1f31a73a4; lang=en-US

No problem, but if the email field is in the middle, no information can be extracted.  
Such as:  
Token=ecc47f17abc040928c3c89c1f31a73a4; [email=cloris@ucan.com](mailto:email=cloris@ucan.com); lang=en-US

Ask for advice

---

<div class="post-metadata">

**Author:** ![bigphil](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bigphil](https://discuss.elastic.co/u/bigphil)\
**Post date:** [December 6, 2018, 3:46am UTC](https://discuss.elastic.co/t/grok-extract-field-problem/159636/2 "2018-12-06T03:46:57Z")

</div>

For parsing the cookie, you'd be better off using the kv processor for that one field instead of grok. Docs [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/kv-processor.html).

---

<div class="post-metadata">

**Author:** ![ferdina](https://avatars.discourse-cdn.com/v4/letter/f/8491ac/32.png) [@ferdina](https://discuss.elastic.co/u/ferdina)\
**Post date:** [December 6, 2018, 5:59am UTC](https://discuss.elastic.co/t/grok-extract-field-problem/159636/3 "2018-12-06T05:59:00Z")

</div>

thanks bigphil it's sovled  
"kv": {  
"field": "nginx.access.cookie",  
"field\_split": "; ",  
"value\_split": "=",  
"target\_field": "nginx.access.userinfo",  
"ignore\_missing": true  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2019, 6:11am UTC](https://discuss.elastic.co/t/grok-extract-field-problem/159636/4 "2019-01-03T06:11:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.