# Help with grok filter **URL:** \ **Category:** Logstash\ **Created:** [November 29, 2017, 8:18pm UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637 "2017-11-29T20:18:45Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Rafael\_Pereira\_Silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafael_pereira_silva/32/68703_2.png) [@Rafael\_Pereira\_Silva](https://discuss.elastic.co/u/Rafael_Pereira_Silva)\ **Post date:** [November 29, 2017, 8:18pm UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/1 "2017-11-29T20:18:45Z")
Hello, I am dificult with Grok Filter this message: > loc=45671|time=2017-11-27 18:35:02|action=HTTPS Inspect|orig=10.212.12.31|i/f\_dir=inbound|i/f\_name=eth1.315|has\_accounting=0|uuid=\<00000000,00000000,00000000,00000000\>|product=HTTPS Inspection|https\_inspection\_action=Inspect|src=10.123.124.21.12|s\_port=52401|dst=10.112.123.123|service=8080|proto=tcp|HTTPS\_inspection\_rule\_id={D2FCC216-3C25-45CE-B24E-971C603D4141}|HTTPS\_inspection\_rule\_name=SSL Inspection|app\_category=Computers / Internet|matched\_category=Computers / Internet|app\_properties=Computers / Internet,Social Networking,URL Filtering|resource=video-gru2-1.xx.fbcdn.net|user=joaosilva(+)|src\_user\_name=joaosilva(+)|snid=c09ffa3c|\_\_policy\_id\_tag=product=VPN-1 & FireWall-1[db\_tag={5FF5BDB6-9BD3-044F-9F28-23AB0125A137};mgmt=FW-INTERNET;date=1511814737;policy\_name=Standard]|origin\_sic\_name=cn=cp\_mgmt,o=FW-INTERNET-BR-BDC1..9si37asv I need create filter of log... with fields: -Action -Orig -Src -Dst -\_\_policy\_id\_tag -user -resource Can someone help me with this pattern? ---
**Author:** ![luiz.santos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luiz.santos/32/24664_2.png) [@luiz.santos](https://discuss.elastic.co/u/luiz.santos)\ **Post date:** [November 29, 2017, 8:39pm UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/2 "2017-11-29T20:39:12Z")
Hi Rafael, Here you can find the pattern for the first 4 fields: loc=%{NUMBER:loc}|time=%{GREEDYDATA:date}|action=%{DATA:action}|orig=%{IP:ip} the rest of the pattern is pretty much the same. You can use [grok constructor website](http://grokconstructor.appspot.com/do/match) to help you building patterns. The [core patterns of logstash are based on github](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns) too. Please let me know if it helps. Cheers, LG ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [November 30, 2017, 8:09am UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/3 "2017-11-30T08:09:11Z")
Hi, You don't necessarily need to use grok. A combination of grok with kv filter will work as well. Did you try using the following filter plugin? > [Kv filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) Regards, N ---
**Author:** ![Rafael\_Pereira\_Silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafael_pereira_silva/32/68703_2.png) [@Rafael\_Pereira\_Silva](https://discuss.elastic.co/u/Rafael_Pereira_Silva)\ **Post date:** [November 30, 2017, 2:02pm UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/4 "2017-11-30T14:02:04Z")
I Understand the patterns now. But , I will use the KV filter, much easier , rs... Thank you so much. ---
**Author:** ![Rafael\_Pereira\_Silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafael_pereira_silva/32/68703_2.png) [@Rafael\_Pereira\_Silva](https://discuss.elastic.co/u/Rafael_Pereira_Silva)\ **Post date:** [November 30, 2017, 2:02pm UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/5 "2017-11-30T14:02:55Z")
Wol, The KV filter is perfect. Its works with parameters: kv { field\_split =\> "|" value\_split =\> "=" } Thanks. ---
**Author:** ![Rafael\_Pereira\_Silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafael_pereira_silva/32/68703_2.png) [@Rafael\_Pereira\_Silva](https://discuss.elastic.co/u/Rafael_Pereira_Silva)\ **Post date:** [December 5, 2017, 7:08pm UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/6 "2017-12-05T19:08:52Z")
Now, I have all fields in format String and I need make a dashboard that sum of two values. Any idea? ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [December 6, 2017, 10:30am UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/7 "2017-12-06T10:30:07Z")
Hi Rafael, This question has already been answered on the forum. > [@How to convert a field string to long in logstash](https://discuss.elastic.co/t/how-to-convert-a-field-string-to-long-in-logstash/49453): > > HI, How to convert string field to long in logstash. When i configured data type as long like below logstash not running. mutate { convert =\> { "clientid" =\> "long" } convert =\> { "groupid" =\> "long" } convert =\> { "teamid" =\> "long" } convert =\> { "userid" =\> "long" } convert =\> { "serviceid" =\> "long" } convert =\> { "eventid" =\> "long" } convert =\> { "pulsecount" =\> "long" } convert =\> { "statusid" =\> "long" } convert =\> { "ostype" =\> "long" } convert =\> { "dvpdropstate" =\> "long"… Also, you should not ask all your questions in the same thread. You should create a new thread if the current doubt is solved. Regards, N ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 3, 2018, 10:30am UTC](https://discuss.elastic.co/t/help-with-grok-filter/109637/8 "2018-01-03T10:30:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.