# How can a public field be filtered by a grok regular expression for multiple unordered logs containing public fields?

**URL:** <https://discuss.elastic.co/t/how-can-a-public-field-be-filtered-by-a-grok-regular-expression-for-multiple-unordered-logs-containing-public-fields/138673>\
**Category:** Logstash\
**Created:** [July 5, 2018, 9:03am UTC](https://discuss.elastic.co/t/how-can-a-public-field-be-filtered-by-a-grok-regular-expression-for-multiple-unordered-logs-containing-public-fields/138673 "2018-07-05T09:03:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sun\_changlong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sun_changlong/32/39036_2.png) [@sun\_changlong](https://discuss.elastic.co/u/sun_changlong)\
**Post date:** [July 5, 2018, 9:03am UTC](https://discuss.elastic.co/t/how-can-a-public-field-be-filtered-by-a-grok-regular-expression-for-multiple-unordered-logs-containing-public-fields/138673/1 "2018-07-05T09:03:05Z")

</div>

For example, the following are the contents of the log:

> label1=aaa ecorder=taw vsid=3 sub\_type=bbbb dst\_addr=1.1.1.1  
> label2=ttt dst\_addr=1.1.1.1 vsid=3 sub\_type=bbbbtest  
> der=taaa label3=www dst\_addr=1.1.1.1 vsid=3 sub\_type=bbbbtest  
> eco=daf dst\_addr=1.1.1.1 label1=aaa vsid=3 sub\_type=bbbbtest

They all contain public fields: dst\_addr, sub\_type, vsid；  
Can I filter out public fields using only one grok regular expression statement and send them to elasticsearch??

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 5, 2018, 9:32am UTC](https://discuss.elastic.co/t/how-can-a-public-field-be-filtered-by-a-grok-regular-expression-for-multiple-unordered-logs-containing-public-fields/138673/2 "2018-07-05T09:32:28Z")

</div>

It seems like the kv filter would be better suited than grok for that type of data.

---

<div class="post-metadata">

**Author:** ![sun\_changlong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sun_changlong/32/39036_2.png) [@sun\_changlong](https://discuss.elastic.co/u/sun_changlong)\
**Post date:** [July 5, 2018, 9:57am UTC](https://discuss.elastic.co/t/how-can-a-public-field-be-filtered-by-a-grok-regular-expression-for-multiple-unordered-logs-containing-public-fields/138673/3 "2018-07-05T09:57:59Z")

</div>

Hi.Christian\_Dahlqvist：  
I just want to send some content to elasticsearch. for example ,the log is :

> label1 = aaa ecorder = taw vsid = 3 sub\_type = bbbb dst\_addr = 1.1.1.1

i just want to send sub\_type and dst\_addr to the elasticsearch,as a field index.The order of the log content is different each time, but both contain this field.Can this help me?  
If it can, can you give me an example? Thank you very much.

---

<div class="post-metadata">

**Author:** ![sun\_changlong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sun_changlong/32/39036_2.png) [@sun\_changlong](https://discuss.elastic.co/u/sun_changlong)\
**Post date:** [July 6, 2018, 1:51am UTC](https://discuss.elastic.co/t/how-can-a-public-field-be-filtered-by-a-grok-regular-expression-for-multiple-unordered-logs-containing-public-fields/138673/4 "2018-07-06T01:51:20Z")

</div>

Hi，Christian\_Dahlqvist. I successfully filtered by using the settings below, thank you for your tips

```
kv {
   source => "message"
   field_split => " ?"
   value_split => "="
   include_keys => ["dst_addr","sub_type"]
 }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2018, 1:51am UTC](https://discuss.elastic.co/t/how-can-a-public-field-be-filtered-by-a-grok-regular-expression-for-multiple-unordered-logs-containing-public-fields/138673/5 "2018-08-03T01:51:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.