# Grok newbie requesting guidance

**URL:** <https://discuss.elastic.co/t/grok-newbie-requesting-guidance/127492>\
**Category:** Logstash\
**Created:** [April 10, 2018, 1:43pm UTC](https://discuss.elastic.co/t/grok-newbie-requesting-guidance/127492 "2018-04-10T13:43:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![camerodity](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/camerodity/32/29818_2.png) [@camerodity](https://discuss.elastic.co/u/camerodity)\
**Post date:** [April 10, 2018, 1:43pm UTC](https://discuss.elastic.co/t/grok-newbie-requesting-guidance/127492/1 "2018-04-10T13:43:46Z")

</div>

Greetings! I am using the grok filter in Logstash to parse some metrics output that were normally sent to Ganglia, and we want to now use in Kibana for various Dashboard/Visualizations. A typical log file entry is along the lines of:

type=[TIMER|METER|GAUGE], name=\<metric\_name\>, count=, additional\_fields=, (where additional fields could be count= , max= , min= , median= ,etc..)

I am working on a grok pattern to put the additional\_fields in their own logstash fields if they are present in the log output, but if they aren't (for example the TIMER type may not have the mean\_rate field whereas the METER type does).

Is there a way to have one grok pattern to accomplish this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 10, 2018, 1:56pm UTC](https://discuss.elastic.co/t/grok-newbie-requesting-guidance/127492/2 "2018-04-10T13:56:29Z")

</div>

A [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) might be a better approach.

---

<div class="post-metadata">

**Author:** ![camerodity](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/camerodity/32/29818_2.png) [@camerodity](https://discuss.elastic.co/u/camerodity)\
**Post date:** [April 10, 2018, 2:55pm UTC](https://discuss.elastic.co/t/grok-newbie-requesting-guidance/127492/3 "2018-04-10T14:55:25Z")

</div>

Thanks! With a slight bit of tweaking with the KV filter I am now able to have the metric fields show up in Kibana correctly! I really appreciate your response.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2018, 2:55pm UTC](https://discuss.elastic.co/t/grok-newbie-requesting-guidance/127492/4 "2018-05-08T14:55:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.