# Grok processor to parse specific fields of IIS Logs message field

**URL:** <https://discuss.elastic.co/t/grok-processor-to-parse-specific-fields-of-iis-logs-message-field/249346>\
**Category:** Kibana\
**Created:** [September 21, 2020, 11:32am UTC](https://discuss.elastic.co/t/grok-processor-to-parse-specific-fields-of-iis-logs-message-field/249346 "2020-09-21T11:32:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chand/32/69706_2.png) [@chand](https://discuss.elastic.co/u/chand)\
**Post date:** [September 21, 2020, 11:32am UTC](https://discuss.elastic.co/t/grok-processor-to-parse-specific-fields-of-iis-logs-message-field/249346/1 "2020-09-21T11:32:24Z")

</div>

Hi,

I've the following grok processor, which basically splits message field data into multiple fields. In my case message field data changes every time for each log entry. How would I pass the message field data dynamically?

> POST \_ingest/pipeline/\_simulate  
> {  
> "pipeline": {  
> "description" : "...",  
> "processors": [  
> {  
> "grok": {  
> "field": "message",  
> "patterns": ["%{DATESTAMP:timestamp} %{DATA} %{WORD:request.method} %{DATA:request.url} - %{NUMBER:port} - %{DATA} %{GREEDYDATA:useragent} - %{NUMBER:response.status\_code} %{GREEDYDATA} %{NUMBER:response.time-taken}"]  
> }  
> }  
> ]  
> },  
> "docs":[  
> {  
> "\_source": {  
> "message": "2020-09-21 10:55:44 ::1 GET / - 80 - ::1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/85.0.4183.102+Safari/537.36 - 304 0 0 0"  
> }  
> }  
> ]  
> }

I tried passing `"message": *` instead of `"message": "2020-09-21 10:55:44 ::1 GET / - 80 - ::1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/85.0.4183.102+Safari/537.36 - 304 0 0 0"` but it is not working.

How do can we do this?  
Does dynamicity of the `message` 's value in the grok processor is made to support it?

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [September 23, 2020, 4:25pm UTC](https://discuss.elastic.co/t/grok-processor-to-parse-specific-fields-of-iis-logs-message-field/249346/2 "2020-09-23T16:25:32Z")

</div>

Hi  
This is not a Kibana related question, you might get more help in #elastic-stack:elasticsearch .  
But you should clarify your issue. You don't want to split ho the message? If you want to help with grok patterns our grok debugger can be helpful

> **[Debugging grok expressions | Kibana Guide \[7.9\] | Elastic](https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html)**

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2020, 4:25pm UTC](https://discuss.elastic.co/t/grok-processor-to-parse-specific-fields-of-iis-logs-message-field/249346/3 "2020-10-21T16:25:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.