# GROK filter for specific keyword and values

**URL:** <https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808>\
**Category:** Logstash\
**Created:** [June 26, 2020, 8:02am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808 "2020-06-26T08:02:33Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akshara](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Akshara](https://discuss.elastic.co/u/Akshara)\
**Post date:** [June 26, 2020, 8:02am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/1 "2020-06-26T08:02:34Z")

</div>

> LOG MSG : "2020-05-13 09:30:15.405 [localhost] [Services] [Request Id : 06118032-ba2f-406e-b6b3-89f0511924ba] [User Id : [HUNTER@UK.B-AND-Q.COM](mailto:HUNTER@UK.B-AND-Q.COM)] INFO com.logging.aspect.AspectController:120 - [1242,124202,] Exit LookupLastTransaction: Output ["Transaction\_id =RT1242124202130519002650 TransactionDateTime =com.store.DateTimeCommonData@5f4c1899 TotalQuantity =6 TenderTotal = GrandTotal = TotalAmount =�29.94 ReturnAmount =�0.00"] "

Above line is my log message.As I am new to GROK filter I am finding it very difficult to parse the Total Amount as separate filed and send that to kibana. Can some one pls help how to filter the value as separate filed?

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [June 26, 2020, 8:21am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/2 "2020-06-26T08:21:25Z")

</div>

Hi Akshara - do you have your grok for the rest of the log message? Or do you only want to take the "TotalAmount" value out?

---

<div class="post-metadata">

**Author:** ![Akshara](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Akshara](https://discuss.elastic.co/u/Akshara)\
**Post date:** [June 26, 2020, 8:52am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/3 "2020-06-26T08:52:34Z")

</div>

Hi Jason

This is my GROK filter  
%{GREEDYDATA}(?\< TotalAmount \>(?\<= TotalAmount =�)[^&]+)(?\< ReturnAmount \>(?\<= ReturnAmount =�)[^&])

When I use this the output is coming like this  
{  
"TotalSalesAmount": "29.94 TotalReturnAmount =�",  
"TotalReturnAmount": "0"  
}  
All I want is some thing like this  
{  
"TotalSalesAmount": "29.94 ",  
"TotalReturnAmount": "0.00"  
}

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [June 26, 2020, 8:59am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/4 "2020-06-26T08:59:13Z")

</div>

Try this (not using any regex patterns) so make sure it will work with all your possible options

`%{GREEDYDATA}TotalAmount%{SPACE}=%{DATA}%{NUMBER:TotalSalesAmount}%{SPACE}ReturnAmount%{SPACE}=%{DATA}%{NUMBER:TotalReturnAmount}`

---

<div class="post-metadata">

**Author:** ![Akshara](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Akshara](https://discuss.elastic.co/u/Akshara)\
**Post date:** [June 26, 2020, 9:06am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/5 "2020-06-26T09:06:26Z")

</div>

Hi Jason,  
Thx for the response.But it is not working

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [June 26, 2020, 9:09am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/6 "2020-06-26T09:09:39Z")

</div>

What's the error you get? See below screenshot:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b82b5bb6fa496ebafa2daf546ceb90628b50b11b.png)

---

<div class="post-metadata">

**Author:** ![Akshara](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Akshara](https://discuss.elastic.co/u/Akshara)\
**Post date:** [June 26, 2020, 9:23am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/7 "2020-06-26T09:23:51Z")

</div>

Hi Jason,Thankyou verymuch for helping me. It is working in grokdebug.BUt when I try this in Kibana debugger it is not working. I am not sure what is the issue

---

<div class="post-metadata">

**Author:** ![Akshara](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Akshara](https://discuss.elastic.co/u/Akshara)\
**Post date:** [June 26, 2020, 9:26am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/8 "2020-06-26T09:26:03Z")

</div>

![Screen Shot 2020-06-26 at 14.52.16](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c75876fbfc5fbd0525cbfa4609d3bcffbf215844.png)

---

<div class="post-metadata">

**Author:** ![Akshara](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Akshara](https://discuss.elastic.co/u/Akshara)\
**Post date:** [June 26, 2020, 9:57am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/9 "2020-06-26T09:57:00Z")

</div>

Thanks a Ton Jason.It worked. It was my my Bad I did a mistake in debugger.  
You saved my life...

I have few questions  
1.If I need to add one more filter like this means  
%{GREEDYDATA}Cash tenderAmount%{SPACE}=%{DATA}%{NUMBER:CashTenderAmount}

for log which will be printed in another line means ,how can I add multiple GROK filters in logsatsh.conf file?

2.If my log file has several other information which is printed in different lines means ,then if I use this GROK filters will fail or what?

Thanks

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [June 26, 2020, 11:11am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/10 "2020-06-26T11:11:47Z")

</div>

I think I understood. You have one logstash.conf file and you want 2 different grok patterns to match two different potential log messages? You'd use this:

```
grok {
match => [
  "message", "GROKPattern1",
  "message", "GROKPattern2"
 
        ]
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2020, 11:11am UTC](https://discuss.elastic.co/t/grok-filter-for-specific-keyword-and-values/238808/11 "2020-07-24T11:11:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.