# Grok filter for mysql queries?

**URL:** https://discuss.elastic.co/t/grok-filter-for-mysql-queries/56027
**Category:** Logstash
**Created:** [July 20, 2016, 8:40pm UTC](https://discuss.elastic.co/t/grok-filter-for-mysql-queries/56027 "2016-07-20T20:40:03Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Jon\_Slusher](https://avatars.discourse-cdn.com/v4/letter/j/58956e/32.png) [@Jon\_Slusher](https://discuss.elastic.co/u/Jon_Slusher)
#### Post date: [July 20, 2016, 8:40pm UTC](https://discuss.elastic.co/t/grok-filter-for-mysql-queries/56027/1 "2016-07-20T20:40:03Z")

</div>

I have mysql slowlogs in logstash and I'm wondering if anyone has had any luck parsing the query section to try and categorize statements. I'm stuck right now trying to split up the query by words in capital letters. I'm thinking that I can at least separate the initial statement. The specific question is this: how can I filter a message like this one so that I can at least deal with each section of the query split by words in capital letters?

```
SELECT column_one, column_two, COUNT(DISTINCT IF(column_three > 0, CONCAT('m_', column_three), CONCAT('r_', column_one))) AS tally FROM column_four WHERE ...

```

Does anyone know how I could filter this into:

```
field1: SELECT column_one, column_two, 
field2: COUNT(DISTINCT IF(column_three > 0,
field3: CONCAT('m_', column_three), 
field4: AS tally 
... etc
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:47am UTC](https://discuss.elastic.co/t/grok-filter-for-mysql-queries/56027/2 "2017-07-06T04:47:11Z")

</div>