# Grok filter by values

**URL:** https://discuss.elastic.co/t/grok-filter-by-values/280988
**Category:** Logstash
**Created:** [August 11, 2021, 6:11am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988 "2021-08-11T06:11:04Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![IsAa](https://avatars.discourse-cdn.com/v4/letter/i/6bbea6/32.png) [@IsAa](https://discuss.elastic.co/u/IsAa)
#### Post date: [August 11, 2021, 6:11am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988/1 "2021-08-11T06:11:04Z")

</div>

Hi Everyone,

I have a text in my input as follows,

```auto
The following text contains {"Food":"Fruit","Type":"Apple"}

```

I am trying to structure my output data to also contain fields

```auto
Food: Fruit
Type: Apple

```

I was looking into grok filter, to help me achieve this.

I understand there are already some patterns in place to extract other log details such as timestamp, ip etc.

I also have looked into custom patterns (which uses regex)

I am just wondering if it is possible to use custom patterns to extract these fields e.g. Fruit and Type.

Or I should be looking into some other filter operation instead of using grok.

As you can see; they are all string values

Thanks

---

<div class="post-metadata">

### Author: ![ErSumit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ersumit/32/88708_2.png) [@ErSumit](https://discuss.elastic.co/u/ErSumit)
#### Post date: [August 11, 2021, 6:31am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988/2 "2021-08-11T06:31:46Z")

</div>

something I can quickly think on this is to parse message like

```auto
grok {
 %{DATA:log.initial_text}\{%{DATA:key_values_string}\}
}

```

so you will have key\_values\_string = "Food":"Fruit","Type":"Apple"  
and you will be able to parse it with kv filter

---

<div class="post-metadata">

### Author: ![ErSumit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ersumit/32/88708_2.png) [@ErSumit](https://discuss.elastic.co/u/ErSumit)
#### Post date: [August 11, 2021, 7:02am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988/3 "2021-08-11T07:02:16Z")

</div>

I belive best solution could be

1. use grok to get json in separate field

```auto
    grok {
        match => {
            "message" => ["%{DATA:log.initial_message}%{JSONOBJ:json_body}"]
        }
        pattern_definitions => {
            #JSONOBJ {.*$
            "JSONOBJ" => "{.*$"
        }
    }

```

1. use json filter to parse it

```auto
json {
    source => "json_body"
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68516f8113fd7a4a51b2a13aa8aa1ff5677fc00c.png)

Cheers!

---

<div class="post-metadata">

### Author: ![IsAa](https://avatars.discourse-cdn.com/v4/letter/i/6bbea6/32.png) [@IsAa](https://discuss.elastic.co/u/IsAa)
#### Post date: [August 12, 2021, 4:34am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988/4 "2021-08-12T04:34:04Z")

</div>

Yeah that seems to be the solution to extract the json body out.  
I am playing with other patterns to suit by input message.  
Thanks 😃

---

<div class="post-metadata">

### Author: ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [August 12, 2021, 5:19am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988/5 "2021-08-12T05:19:42Z")

</div>

You probably don't want to use the grok filter to parse the contents of the JSON. Simply extract the JSON into a new value as in the above example. Then use the `json` filter to unmarshal the JSON value into fields.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 9, 2021, 5:20am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988/6 "2021-09-09T05:20:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.