# Grok parser to return only numbers
**URL:** https://discuss.elastic.co/t/grok-parser-to-return-only-numbers/94294
**Category:** Logstash
**Created:** [July 24, 2017, 9:35am UTC](https://discuss.elastic.co/t/grok-parser-to-return-only-numbers/94294 "2017-07-24T09:35:27Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)
#### Post date: [July 24, 2017, 9:35am UTC](https://discuss.elastic.co/t/grok-parser-to-return-only-numbers/94294/1 "2017-07-24T09:35:27Z")
I have a field where I will get phone number. Here are the examples.
1-800-1234
1(800)1234
18001234
1 800 1234
If the format is matching anyone I want to save the number in ES like 18001234. Can anyone help for the grok pattern
---
### Author:  [@CDR](https://discuss.elastic.co/u/CDR)
#### Post date: [July 24, 2017, 6:02pm UTC](https://discuss.elastic.co/t/grok-parser-to-return-only-numbers/94294/2 "2017-07-24T18:02:34Z")
```
grok{
match => {"message" => ["%{INT:first} ?(-|\()?%{INT:second} ?(-|\))?%{INT:third}"]
}
}
mutate{
add_field => {
"number"=>"%{first}%{second}%{third}"
}
}
```
---
### Author:  [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)
#### Post date: [July 25, 2017, 6:21am UTC](https://discuss.elastic.co/t/grok-parser-to-return-only-numbers/94294/3 "2017-07-25T06:21:20Z")
```
filter {
mutate {
gsub => [
"number", "[\s(-]", ""
]
}
}
```
I found out this. Which one is better to use???
---
### Author:  [@CDR](https://discuss.elastic.co/u/CDR)
#### Post date: [July 25, 2017, 12:06pm UTC](https://discuss.elastic.co/t/grok-parser-to-return-only-numbers/94294/4 "2017-07-25T12:06:41Z")
Yours may be a touch more efficient. Use whichever one makes the most sense to you. That way if you need to change/adjust it you are confident in what is happening
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2017, 12:07pm UTC](https://discuss.elastic.co/t/grok-parser-to-return-only-numbers/94294/5 "2017-08-22T12:07:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.