# Grok on source field

**URL:** <https://discuss.elastic.co/t/grok-on-source-field/120800>\
**Category:** Logstash\
**Created:** [February 21, 2018, 9:38am UTC](https://discuss.elastic.co/t/grok-on-source-field/120800 "2018-02-21T09:38:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dykan\_P](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Dykan\_P](https://discuss.elastic.co/u/Dykan_P)\
**Post date:** [February 21, 2018, 9:38am UTC](https://discuss.elastic.co/t/grok-on-source-field/120800/1 "2018-02-21T09:38:30Z")

</div>

Hello,

I'm beginner on stack ELK 5.6 and I have a problem : I try to recover my virtualhost and put it in a new field but my grok is false.

The data I want is in source but she has different form :  
/var/www/clients/client2/web57/log/20180221-access.log or  
/var/www/clients/client1/web62/log/20180221-access.log or  
/var/www/clients/client2/web53/log/20180221-access.log

My virtual host is web57 or web62 or web53 and many others and i want record this in a new field (virtualhost).

I try this grok but it's false :

grok {  
match =\> { "source" =\> "/var/www/clients/%{WORD}/%{WORD:virtualhost}/%{DATA}" }  
}

Thanks for your response.  
Friendly.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 21, 2018, 10:16am UTC](https://discuss.elastic.co/t/grok-on-source-field/120800/2 "2018-02-21T10:16:23Z")

</div>

That filter looks correct. Please show an example event that Logstash produces. Use a `stdout { codec => rubydebug }` output or copy/paste from Kibana's JSON tab.

---

<div class="post-metadata">

**Author:** ![Dykan\_P](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Dykan\_P](https://discuss.elastic.co/u/Dykan_P)\
**Post date:** [February 21, 2018, 10:33am UTC](https://discuss.elastic.co/t/grok-on-source-field/120800/3 "2018-02-21T10:33:21Z")

</div>

Thanks you actually it works but it took a long time to display properly

Have a nice day !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 10:33am UTC](https://discuss.elastic.co/t/grok-on-source-field/120800/4 "2018-03-21T10:33:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.