# Grok filter needed after filebeat send data **URL:** \ **Category:** Logstash\ **Created:** [October 18, 2016, 9:12pm UTC](https://discuss.elastic.co/t/grok-filter-needed-after-filebeat-send-data/63329 "2016-10-18T21:12:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![cetanhota](https://avatars.discourse-cdn.com/v4/letter/c/7cd45c/32.png) [@cetanhota](https://discuss.elastic.co/u/cetanhota)\ **Post date:** [October 18, 2016, 9:12pm UTC](https://discuss.elastic.co/t/grok-filter-needed-after-filebeat-send-data/63329/1 "2016-10-18T21:12:39Z")
Hello all new at ELK. Been doing well so far, but I have come across 1 problem and I figured it was worth asking. I have filebeat sending me data off several servers. Filebeat is working well and I am able to filter out only the 1 line of data I want: Filesystem /fb/data0 is GOOD, with current percent at 24 % I now want this to be broken down into two columns. /fb/data0 and the number 24, of course 24 will change based on the usage of the file system, but the /fb/data0 will never change. I have looked at the grok filter docs, and to be 100% honest I am just a little lost. Thank you in advance for any tips or advice. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 19, 2016, 6:00am UTC](https://discuss.elastic.co/t/grok-filter-needed-after-filebeat-send-data/63329/2 "2016-10-19T06:00:02Z")
Perhaps [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/) can help you? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/grok-filter-needed-after-filebeat-send-data/63329/3 "2017-07-06T04:33:38Z")