# Grok extract the PR number

**URL:** <https://discuss.elastic.co/t/grok-extract-the-pr-number/103024>\
**Category:** Logstash\
**Created:** [October 6, 2017, 1:54pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024 "2017-10-06T13:54:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikkn](https://avatars.discourse-cdn.com/v4/letter/e/e95f7d/32.png) [@erikkn](https://discuss.elastic.co/u/erikkn)\
**Post date:** [October 6, 2017, 1:54pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024/1 "2017-10-06T13:54:12Z")

</div>

Hey guys,

I have a log file with ~500 lines and I need to extract a few lines. One of the lines I want to extract is: pullrequest=pull request number . Could someone tell me what custom grok pattern I should use to 'only' extract the pull request number? Now I am using the following expression: pullrequest\s\*=\s\*._?$ .  
This expression gives me the whole line, but like I said, I only want the number. With some help of this forum and the grok debugger I created the following expression: (?\<=pullrequest=)._ .  
This expression is working fine within the debugger, but unfortunately I am getting a \_grokparsefailure if I use it within my logstash config.

Thanks :)!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 6, 2017, 2:03pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024/2 "2017-10-06T14:03:38Z")

</div>

`pullrequest=%{INT:name-of-field}$` should work fine (if this is always at the end of the line).

---

<div class="post-metadata">

**Author:** ![erikkn](https://avatars.discourse-cdn.com/v4/letter/e/e95f7d/32.png) [@erikkn](https://discuss.elastic.co/u/erikkn)\
**Post date:** [October 6, 2017, 2:06pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024/3 "2017-10-06T14:06:41Z")

</div>

Thanks for your quick reply @magnusbaeck

To give you a better understanding, this is how the log file looks like:

```
[Pipeline] ansiColor
platform=gcp
pullrequest=5678
[Pipeline] {
[Pipeline] checkout
03:56:14 Cloning the remote Git repository 
<rest of log file>
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 6, 2017, 2:30pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024/4 "2017-10-06T14:30:55Z")

</div>

Okay, and what's the problem with using an expression like the one I gave? Do you have the complete log in a single Logstash event or do you have one event per line?

---

<div class="post-metadata">

**Author:** ![erikkn](https://avatars.discourse-cdn.com/v4/letter/e/e95f7d/32.png) [@erikkn](https://discuss.elastic.co/u/erikkn)\
**Post date:** [October 6, 2017, 2:37pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024/5 "2017-10-06T14:37:10Z")

</div>

So your expression is (almost) working, this is the output I get now:

pull\_request pullrequest=%{INT:pullrequest}$

```
{
  "pull_request": [
[
  "pullrequest=5678"
]
  ],
  "pullrequest": [
[
  "5678"
]
  ]
}

```

As you can see I have an ouput of two lines, while I only need the the second one.

Your question: Do you have the complete log in a single Logstash event or do you have one event per line?  
Answer: It's one log file with ~500 lines with the following input config:

```
  codec => multiline {
  pattern => "Started"
  negate => "true"
  what => "previous"
}
```

---

<div class="post-metadata">

**Author:** ![erikkn](https://avatars.discourse-cdn.com/v4/letter/e/e95f7d/32.png) [@erikkn](https://discuss.elastic.co/u/erikkn)\
**Post date:** [October 6, 2017, 3:11pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024/6 "2017-10-06T15:11:17Z")

</div>

Oeps, my bad: I used your expression as a custom pattern. Now I am just using the following config and it works as expected:  
match =\> {"message" =\> "pullrequest=%{INT:pullrequest}$"}

Thanks @magnusbaeck , you helped me a lot 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2017, 3:11pm UTC](https://discuss.elastic.co/t/grok-extract-the-pr-number/103024/7 "2017-11-03T15:11:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.