# Grok parser

**URL:** <https://discuss.elastic.co/t/grok-parser/118089>\
**Category:** Logstash\
**Created:** [February 1, 2018, 7:11pm UTC](https://discuss.elastic.co/t/grok-parser/118089 "2018-02-01T19:11:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pp\_macrix](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@pp\_macrix](https://discuss.elastic.co/u/pp_macrix)\
**Post date:** [February 1, 2018, 7:11pm UTC](https://discuss.elastic.co/t/grok-parser/118089/1 "2018-02-01T19:11:27Z")

</div>

I am trying to parse my log files. It was working however there is a new requirement and I need new field from the parsed logs.  
Logs are more or less:  
|2018-02-01 13:48:00.882|[v2.8.0.0]|DEBUG|[EndpointFirst] |Session activated (documentId: 508, workflow id: 1)|  
|2018-02-01 13:48:00.901|[v2.8.0.0]|INFO|[Custom.EndpointSecond [Document 508]]|Firing event 'DocumentReceived' on state machine with current state 'Initial' and event argument 'CustomArgument'.|

My grok filter:  
`(?<my_timestamp>%{TIMESTAMP_ISO8601:timestamp})\s*(?<my_version>\[v.{7}])s*(?<my_severity>\s+%{LOGLEVEL:loglevel})\s*(?<my_endpoint>\[.{1,}])\s*(?<my_message>%{DATA:message})`

Now I got the following fields (result from test grok patterns):  
MATCHED  
my\_version [v2.8.0.0]  
my\_timestamp 2018-02-01·13:48:00.901  
timestamp 2018-02-01·13:48:00.901  
my\_endpoint [Custom.EndpointSecond·[Document·508]]  
my\_message   
my\_severity ⇥INFO  
message   
loglevel INFO  
after match: Firing event 'DocumentReceived' on state machine with current state 'Initial' and event argument 'CustomArgument'.

What I want to achieve?

- I would like to have new field \<my\_document\> which should be parsed from [Custom.EndpointSecond·[Document·508]] (if there is no log with [Document x] then this field should be empty.
- I would like to have message populated with the string which starts after \<my\_endpoint\> field.

Any help will be appreciated

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2018, 7:11pm UTC](https://discuss.elastic.co/t/grok-parser/118089/2 "2018-03-01T19:11:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.