# Grok URI extract

**URL:** <https://discuss.elastic.co/t/grok-uri-extract/54836>\
**Category:** Logstash\
**Created:** [July 6, 2016, 2:16pm UTC](https://discuss.elastic.co/t/grok-uri-extract/54836 "2016-07-06T14:16:15Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![munotshubham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munotshubham/32/22663_2.png) [@munotshubham](https://discuss.elastic.co/u/munotshubham)\
**Post date:** [May 31, 2017, 3:54pm UTC](https://discuss.elastic.co/t/grok-uri-extract/54836/8 "2017-05-31T15:54:32Z")

</div>

Hey thanks for replying. I was able to figure that out later.  
Here is the link of my post in which I had an issue. If anyone still looking similar problem and the solution.

> [@KV filter not working](https://discuss.elastic.co/t/kv-filter-not-working/87019):
>
> config file: filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:\[%{POSINT:syslog\_pid}\])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } if [message] =~ "^#" { dro…

---

_[View the full topic](https://discuss.elastic.co/t/grok-uri-extract/54836)._