# Grok Pattern Help with message parsing

**URL:** <https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279>\
**Category:** Logstash\
**Created:** [May 18, 2016, 2:12am UTC](https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279 "2016-05-18T02:12:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![snipervelli](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@snipervelli](https://discuss.elastic.co/u/snipervelli)\
**Post date:** [May 18, 2016, 2:12am UTC](https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279/1 "2016-05-18T02:12:31Z")

</div>

Hi all i am fairly new to Elasticsearch. I have Elasticsearc running and i have some information in my logs that i need to graph and i just don't know how filter it. So here are the contents in my message field that i need filtered.

message:{"name":"monitor","hostname":"[someserver.com](http://someserver.com)","pid":1627,"level":30,"counts":{"dropped\_packets":0,"tcp":12025,"jobsRX":12104,"jobsTX":11476,"jobsCnt":9934,"fpTX":0,"tpRX":0,"leadsRX":11515,"leedsCnt":68749},"msg":"broadcasting..","time":"2016-05-17T20:54:30.112Z","v":0}

Here is my current filter  
if [fields][log\_type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} (?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}

I would ideally like to filter "dropped\_packets":0,"tcp":12025,"jobsRX":12104,"jobsTX":11476,"jobsCnt":9934,"fpTX":0,"tpRX":0,"leadsRX":11515,"leedsCnt":68749 so that i can graph them in kibana 4. Any help will be much appreciated. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 19, 2016, 12:58pm UTC](https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279/2 "2016-05-19T12:58:37Z")

</div>

Your pattern does not match the event at all.

I'll move this to the LS section as it seems that is the core of the problem.

---

<div class="post-metadata">

**Author:** ![snipervelli](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@snipervelli](https://discuss.elastic.co/u/snipervelli)\
**Post date:** [May 20, 2016, 11:41pm UTC](https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279/3 "2016-05-20T23:41:33Z")

</div>

Any chance of telling me what patterns i need to use to accomplish my task?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 23, 2016, 3:47am UTC](https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279/4 "2016-05-23T03:47:30Z")

</div>

I'd suggest you take a look at [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)

---

<div class="post-metadata">

**Author:** ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)\
**Post date:** [May 23, 2016, 5:38am UTC](https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279/5 "2016-05-23T05:38:48Z")

</div>

if your message looks like this i would recommend an kv filter, sth like that (not tested at all):

kv {  
source =\> "message"  
field\_split =\> ","  
value\_split =\> ":"  
trim =\> """  
trimkey =\> """  
}

this will give u field/value combinations like they appear in the log and u can then use mutate filter to rename the field as u like

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/grok-pattern-help-with-message-parsing/50279/6 "2017-07-06T04:56:43Z")

</div>