# GROK pattern extract

**URL:** <https://discuss.elastic.co/t/grok-pattern-extract/110146>\
**Category:** Logstash\
**Created:** [December 4, 2017, 12:49pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146 "2017-12-04T12:49:27Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)\
**Post date:** [December 4, 2017, 12:49pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/1 "2017-12-04T12:49:28Z")

</div>

HI,

I am extracting info from string -

[Fri Dec 01 09:00:00.983 2017] [app-pr.com](http://app-pr.com) app-onl-pr-lb app-v1-online-pr-node4 0.017070 200 /rest/internal/itemInfo/123123213/method\_call

GROK pattern:

[%{DATA:timestamp}] %{DATA:app\_url} %{DATA:app\_lb} %{DATA:app\_node} %{NUMBER:response\_time} %{DATA:status} /rest/%{WORD:mthod\_type}/itemInfo/%{DATA:item\_number}/%{WORD:item\_info\_method}

Output-

{  
"timestamp": [  
[  
"Fri Dec 01 09:00:00.983 2017"  
]  
],  
"app\_url": [  
[  
"[app-pr.com](http://app-pr.com)"  
]  
],  
"app\_lb": [  
[  
"app-onl-pr-lb"  
]  
],  
"app\_node": [  
[  
"app-v1-online-pr-node4"  
]  
],  
"response\_time": [  
[  
"0.017070"  
]  
],  
"BASE10NUM": [  
[  
"0.017070"  
]  
],  
"status": [  
[  
"200"  
]  
],  
"mthod\_type": [  
[  
"internal"  
]  
],  
"item\_number": [  
[  
"123123213"  
]  
],  
"item\_info\_method": [  
[  
"method\_call"  
]  
]  
}

Issue- I am not able to preserve the request URL also. I want additional output with field request url as:

/rest/internal/itemInfo/123123213/method\_call

Is there a way to do achieve the same. Thanks in advance

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 4, 2017, 1:00pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/2 "2017-12-04T13:00:36Z")

</div>

Using multiple `DATA` and/or `GREEDYDATA` patterns can be slow and give incorrect results. It looks like most of your `DATA` patterns (except for the timestamp field) could be replaced with the more selecting `NOTSPACE` pattern. To get the url as well as the component, capture the full url in your current pattern, and then apply another grok or dissect filter just on this url field to extract the components.

---

<div class="post-metadata">

**Author:** ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)\
**Post date:** [December 4, 2017, 1:05pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/3 "2017-12-04T13:05:43Z")

</div>

Hi Christian,

Thanks for response. Can you please provide example with reference to my query. I mean how to nest GROK inside another GROK

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 4, 2017, 1:16pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/4 "2017-12-04T13:16:26Z")

</div>

Don't try to nest - use two separate grok filters, one working on the message field and one on the extracted url field.

---

<div class="post-metadata">

**Author:** ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)\
**Post date:** [December 4, 2017, 1:18pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/5 "2017-12-04T13:18:27Z")

</div>

Will it produce duplicate results in Kibana? I am worried it will lead to incorrect count of extracted URL.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 4, 2017, 1:22pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/6 "2017-12-04T13:22:58Z")

</div>

Try something like this (not tested):

```auto
grok {
	match => { "message" => "[%{DATA:timestamp}] %{NOTSPACE:app_url} %{NOTSPACE:app_lb} %{NOTSPACE:app_node} %{NUMBER:response_time} %{NOTSPACE:status} %{GREEDYDATA:url}" }
}

grok {
	match => { "url" => "/rest/%{WORD:mthod_type}/itemInfo/%{DATA:item_number}/%{WORD:item_info_method}" }
}

```

---

<div class="post-metadata">

**Author:** ![Sumit\_Sijaria](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sumit\_Sijaria](https://discuss.elastic.co/u/Sumit_Sijaria)\
**Post date:** [December 4, 2017, 1:27pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/7 "2017-12-04T13:27:25Z")

</div>

Thanks a lot 🙂 I will try and let you know

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2018, 1:27pm UTC](https://discuss.elastic.co/t/grok-pattern-extract/110146/8 "2018-01-01T13:27:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.