# Grok filter inquiry

**URL:** https://discuss.elastic.co/t/grok-filter-inquiry/89064
**Category:** Logstash
**Created:** [June 12, 2017, 2:49pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064 "2017-06-12T14:49:23Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)
#### Post date: [June 12, 2017, 2:49pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/1 "2017-06-12T14:49:23Z")

</div>

Hello, how to extract a specific word out of a string without spaces, for example:  
`'stock_status': 'IN_STOCK','title_ar': u'Happy Wedding Card'`

I want to extract the (IN\_STOCK), I tried:

> grok{  
> match =\> ["message", "'stock\_status': '%{GREEDYDATA:stock\_value}',"]  
> }

But the output is:  
` "IN_STOCK','title_ar': u'Happy Wedding Card"`

How can I add something like a termination character (e.g: comma).

---

<div class="post-metadata">

### Author: ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)
#### Post date: [June 12, 2017, 10:09pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/2 "2017-06-12T22:09:20Z")

</div>

You could try this pattern in your Grok:

```
grok{
    match => ["message", "'stock_status': '.*status\'\:\s\'(?<stock_status>\w*)"]
}
```

---

<div class="post-metadata">

### Author: ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)
#### Post date: [June 13, 2017, 7:19pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/3 "2017-06-13T19:19:05Z")

</div>

@Kryten I tried it, but it doesn't match ☹

---

<div class="post-metadata">

### Author: ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)
#### Post date: [June 13, 2017, 7:34pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/4 "2017-06-13T19:34:40Z")

</div>

Hmm... It should:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bd896fae44d2fe4e881bd3426d74d820f7eb88be.jpg)

Is the example line you supplied accurate?

---

<div class="post-metadata">

### Author: ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)
#### Post date: [June 13, 2017, 7:52pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/5 "2017-06-13T19:52:35Z")

</div>

But shouldn't I try the whole pattern instead?

 ![](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c56ab0c5f73b1819c669e9164d46e4abf7455446.jpg)

---

<div class="post-metadata">

### Author: ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)
#### Post date: [June 13, 2017, 7:57pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/6 "2017-06-13T19:57:45Z")

</div>

Do me a favour.. paste the pattern you are trying to use into the message so I can use it too to see what you see..  
Why do you want more in the pattern than you need?

---

<div class="post-metadata">

### Author: ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)
#### Post date: [June 13, 2017, 8:43pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/7 "2017-06-13T20:43:25Z")

</div>

Issue fixed, this one is working now

```
grok{
    match => ["message", ".*status\'\:\s\'(?<stock_status>\w*)"]
}

```

Thank you @Kryten!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2017, 8:43pm UTC](https://discuss.elastic.co/t/grok-filter-inquiry/89064/8 "2017-07-11T20:43:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.