# GROK pattern for message

**URL:** https://discuss.elastic.co/t/grok-pattern-for-message/174705
**Category:** Elasticsearch
**Created:** [April 1, 2019, 4:32am UTC](https://discuss.elastic.co/t/grok-pattern-for-message/174705 "2019-04-01T04:32:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![\_gandhe](https://avatars.discourse-cdn.com/v4/letter/_/ea5d25/32.png) [@\_gandhe](https://discuss.elastic.co/u/_gandhe)
#### Post date: [April 1, 2019, 4:32am UTC](https://discuss.elastic.co/t/grok-pattern-for-message/174705/1 "2019-04-01T04:32:19Z")

</div>

I have following log line: -

2019-03-29 05:20:18 INFO::ModelId=model-cps-czooarea05nap01::ServiceName=Data Monitoring Tool::SolutionName=PM::ProcessStep=sitetags::SystemGuid=1d950a95-861b-47d8-b44e-2e220da138cc::Quality=Good::Description=Operation check is Success.

I want to extract following values using GROK pattern: -  
model-cps-czooarea05nap01  
Data Monitoring Tool  
PM  
sitetags  
1d950a95-861b-47d8-b44e-2e220da138cc  
Good  
Operation check is Success.

I am stuck at extracting "Data Monitoring Tool" as it consists of spaces within the words.  
Here is pattern so far

%{TIMESTAMP\_ISO8601:LogDate} %{LOGLEVEL:Status}::ModelId=%{DATA:ModelID}::ServiceName=%{DATA}

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [April 1, 2019, 8:06am UTC](https://discuss.elastic.co/t/grok-pattern-for-message/174705/2 "2019-04-01T08:06:49Z")

</div>

hey,

instead of using grok, how about the `kv` ingest processor? See this example

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "_description",
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": [
            "%{TIMESTAMP_ISO8601:date} %{WORD:loglevel}::%{GREEDYDATA:keys}"
          ]
        }
      },
      {
        "kv": {
          "field": "keys",
          "field_split": "::",
          "value_split": "=",
          "target_field" : "my_keys"
        }
      },
      {
        "remove": {
          "field": ["message", "keys"]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "2019-03-29 05:20:18 INFO::ModelId=model-cps-czooarea05nap01::ServiceName=Data Monitoring Tool::SolutionName=PM::ProcessStep=sitetags::SystemGuid=1d950a95-861b-47d8-b44e-2e220da138cc::Quality=Good::Description=Operation check is Success."
      }
    }
  ]
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2019, 8:06am UTC](https://discuss.elastic.co/t/grok-pattern-for-message/174705/3 "2019-04-29T08:06:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.