# Help With Custom Grok Parsing

**URL:** <https://discuss.elastic.co/t/help-with-custom-grok-parsing/105705>\
**Category:** Logstash\
**Created:** [October 30, 2017, 4:13am UTC](https://discuss.elastic.co/t/help-with-custom-grok-parsing/105705 "2017-10-30T04:13:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![uppaljs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/uppaljs/32/11535_2.png) [@uppaljs](https://discuss.elastic.co/u/uppaljs)\
**Post date:** [October 30, 2017, 4:13am UTC](https://discuss.elastic.co/t/help-with-custom-grok-parsing/105705/1 "2017-10-30T04:13:32Z")

</div>

Hi,

My log is coming in the format ( its either OK for successful with a set of value or ERR for failure with a different set of values )

ok{fus=192.168.20.1, ful=44001, fui=672a000249d481f10000000c59f5efe3, fuc=0, fuq=2, fut=2017-10-29 19:42:35, fud=6791, fss=2, fst=2, fsi=12, fso=0, fsa=0, fsr=6, cuc=1}, ,

JSON ( after split on , ) :  
"ratingirrelevantoutput": [  
"ok{fus=192.168.20.1",  
" ful=44001",  
" fui=672a000249d481f10000000c59f5efe3",  
" fuc=0",  
" fuq=2",  
" fut=2017-10-29 19:42:35",  
" fud=6791",  
" fss=2",  
" fst=2",  
" fsi=12",  
" fso=0",  
" fsa=0",  
" fsr=6",  
" cuc=1}",  
" ",  
" "  
],

or

, err{fci=3d05cf03c13810cf0000000159f600ce, fec=26, fee=3, fei=2:20:10003:0, foc=0},

JSON ( after split on , ) :  
"ratingirrelevantoutput": [  
"",  
" err{fci=3d05cf03c13810cf0000000159f600ce",  
" fec=26",  
" fee=3",  
" fei=2:20:10003:0",  
" foc=0}",  
" "  
],

I would like to identify which one is it ( ok or err ) and based on that pick up values of each parameter and move it to a separate field.

How would one achieve this with grok? I am currently using a mix of split , gsub, trim to achieve part of it and was wondering if there is a better way / optimised way of achieving the same with grok.

Thanks,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 30, 2017, 12:41pm UTC](https://discuss.elastic.co/t/help-with-custom-grok-parsing/105705/2 "2017-10-30T12:41:22Z")

</div>

Use grok to extract the result (ok or err) into one field and everything within the curly braces into another field, then use the kv filter to process the latter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2017, 12:41pm UTC](https://discuss.elastic.co/t/help-with-custom-grok-parsing/105705/3 "2017-11-27T12:41:51Z")

</div>

Closed on November 27, 2017, 12:41pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.