# Grok pattern extract data based on column position
**URL:** https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126
**Category:** Logstash
**Created:** [April 10, 2019, 2:23am UTC](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126 "2019-04-10T02:23:05Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@bruinjoe](https://discuss.elastic.co/u/bruinjoe)
#### Post date: [April 10, 2019, 2:23am UTC](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126/1 "2019-04-10T02:23:05Z")
I have a mainframe export. I need to parse it based on column position. Does Logstash grok support extraction based on column position?
Example line: M4349456
First two characters dept number: M4
Characters 3-6 mail stop: 3494
Characters 7-8 room number: 56
---
### Author:  [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)
#### Post date: [April 10, 2019, 10:25am UTC](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126/2 "2019-04-10T10:25:20Z")
Hi maybe you can follow this solution.
> [@Logstash substring a field using position](https://discuss.elastic.co/t/logstash-substring-a-field-using-position/32569):
>
> hi guys, if i want to extract first 3 characters from a field, how do i go about it. Thanks, sam
You can create a separate ruby code block and put the zero based integer.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 10, 2019, 11:05am UTC](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126/3 "2019-04-10T11:05:00Z")
You can do it in grok using
```
grok { match => { "someField" => "^(?..)(?....)(?..)" } }
```
---
### Author:  [@bruinjoe](https://discuss.elastic.co/u/bruinjoe)
#### Post date: [April 12, 2019, 4:23pm UTC](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126/4 "2019-04-12T16:23:05Z")
Thank you Archelle and Badger both information was useful. I ended up using Badger's recommendation.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2019, 4:23pm UTC](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126/5 "2019-05-10T16:23:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.