# Grok pattern to split the stream name! **URL:** \ **Category:** Logstash\ **Created:** [November 16, 2015, 3:56pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696 "2015-11-16T15:56:03Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [November 16, 2015, 3:56pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/1 "2015-11-16T15:56:03Z")
Again, Come with Wowza Log parsing issue ! When I parse the wowza server logs, the stream name come as below, Is there any way to split exact stream name alone from the entire url ?. Convert the below one , **FROM** wowz://www.example.com:443/WH12DH/_definst_/test04\_01|wowz://www.example.com:443/WH12DH/_definst_/test04\_01 **TO** test04\_01 * * * Full Logstash output: ``` "@version" => "1", "@timestamp" => "2015-11-16T08:05:45.821Z", "host" => "10.11.12.202", "type" => "wowzass", "xSeverity" => "INFO", "xCategory" => "session", "xEvent" => "disconnect", "date" => "2015-11-16", "time" => "07:37:54", "xApp" => "WH12DH", "cClientId" => "864083625", "cIp" => "10.11.13.89", "cProto" => "rtmp", "sIp" => "10.11.12.200", "sPort" => "443", "csBytes" => "408359", "scBytes" => "4067", "xDuration" => "4.879", "xSname" => "-", "xStreamId" => " **wowz://www.example.com:443/WH12DH/_definst_/test04_01|wowz://www.example.com:443/WH12DH/_definst_/test04_01"** , ``` ---
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [November 16, 2015, 4:35pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/2 "2015-11-16T16:35:39Z")
Anyone please provide solution for this one ?. ---
**Author:** ![Jackal9301](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackal9301/32/5748_2.png) [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Post date:** [November 16, 2015, 8:36pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/3 "2015-11-16T20:36:40Z")
I'm confused by your question. What part of the stream are you trying to split? ---
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [November 17, 2015, 2:32am UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/4 "2015-11-17T02:32:23Z")
Hi I have configured Wowza Origin and Edge Server. When you try to fetch the video/stream from Edge, it will forward the query to backend origin server [as per the forwarder condition]. In my case, I have mentioned primary and fallback url that separated by "|" symbol. Note : When you check Origin log, it will show only "test04\_01", but in Edge server **log** , it shows like below [mean, shows entire forwarder lone"] wowz://www.example.com:443/WH12DH/_definst_/test04\_01|wowz://www.example.com:443/WH12DH/_definst_/test04\_01 Stream Name : test04\_01 I need to split the stream name alone from the above one. Please advice. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 17, 2015, 6:42am UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/5 "2015-11-17T06:42:12Z")
> **FROM** > wowz://www.example.com:443/WH12DH/_definst_/test04\_01|wowz://www.example.com:443/WH12DH/_definst_/test04\_01 > **TO** > test04\_01 So you basically want to capture everything after the last slash in the string? This'll do: ``` /(?[^/]+)$ ``` This means capture one or more non-slash characters at the end of the string (going backwards until the first slash, i.e. the string's _last_ slash, is encountered). > Anyone please provide solution for this one ?. If you don't want to annoy people don't ping threads until at least 24 hours have passed. If you expect one-hour response time for questions there are plenty of paid options for that. ---
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [November 20, 2015, 2:32pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/6 "2015-11-20T14:32:46Z")
Format 1: **live wowz://test1.example.com:443/live/definst/demo01|wowz://test2.example.com:443/live/definst/demo01 test** Format 2: **live demo01 test** I was tried lot more options, but couldn't write a pattern to match above two condition. Requirement : Using single pattern have to satisfy above two log formats. Please help ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 20, 2015, 2:35pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/7 "2015-11-20T14:35:20Z")
You can list multiple patterns with the grok filter and it'll pick the first one that matches. Or you can do it in a single expression: ``` ^(subexpression1|subexpression2|...|subexpressionN)$ ``` ---
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [November 20, 2015, 2:44pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/8 "2015-11-20T14:44:29Z")
@magnusbaeck Thanks for your reply, I couldn't use the given pattern match along with my existing patterns. ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f90a231d008f5f5d76dfd406ea287ebf063792e6.png) If I get the pattern that would match this one, I will enable sub expression for Format 2 log. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 20, 2015, 2:55pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/9 "2015-11-20T14:55:24Z")
The pattern I gave you assumed that the token you were looking for was at the end of the string, because it was at the end of the string in the example you gave. Now that the rules apparently have changed the expression needs to be adjusted too. This might work: ``` ^%{WORD:app} \S+/(?[^ /]+ %{WORD:id}$ ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696/10 "2017-07-06T05:21:59Z")