# How can i filter this pattern?
**URL:** https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885
**Category:** Logstash
**Created:** [March 17, 2020, 9:27am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885 "2020-03-17T09:27:52Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Ramon\_Mateo](https://discuss.elastic.co/u/Ramon_Mateo)
#### Post date: [March 17, 2020, 9:27am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/1 "2020-03-17T09:27:53Z")
Hi
I try to filter this
`> \"tenantID\": 80334, \"Size\": 11.42, \"FirstDate\": \"15/03/2020 00:09:47\", \"LastDate\": \"15/03/2020 23:59:17\"`
i need this:
tenantID: 80334
Size: 11.42
FirstDate: 15/03/2020 00:09:47
LastDate: 15/03/2020 23:59:17
But i don't know how to do a patter that grook filter data that indicate in black.
Can you help me? I tried a lot of times but i don't know how to get all data that i need with grok. Thanks for advanced!
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 17, 2020, 10:03am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/2 "2020-03-17T10:03:54Z")
Hello there,
what you want to do does not sound difficult (if I got it right) but can you please post here ( **properly spaced and formatted** ) the output of the following pipeline first?
```auto
input {
whatever your input is
}
filter {}
output {
stdout{}
}
```
I'd like to see what your logs look like to logstash. Thanks
---
### Author:  [@Ramon\_Mateo](https://discuss.elastic.co/u/Ramon_Mateo)
#### Post date: [March 17, 2020, 10:07am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/3 "2020-03-17T10:07:25Z")
Hi
Thanks for respond.
This is the output of pipeline show for terminal:
`\"tenantID\": 80334, \"Size\": 11.42, \"FirstDate\": \"15/03/2020 00:09:47\", \"LastDate\": \"15/03/2020 23:59:17\"`
All of this
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 17, 2020, 10:29am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/4 "2020-03-17T10:29:10Z")
Hi there,
this cannot be the output of the terminal since you should have something like:
```
{
"@version" => "..."
"@timestamp" => "..."
"message" => "..."
etc...
}
```
---
### Author:  [@Ramon\_Mateo](https://discuss.elastic.co/u/Ramon_Mateo)
#### Post date: [March 17, 2020, 10:46am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/5 "2020-03-17T10:46:36Z")
> [@Fabio-sama](#):
>
> message
```
{
logstash | "message" => "{\"tenantID\": 81183, \"Size\": 8.54, \"FirstDate\": \"14/03/2020 07:12:18\", \"LastDate\": \"14/03/2020 11:42:09\"}"
logstash | }
```
I have a mutate that remove @timestampt etc...
Thanks for your help!
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 17, 2020, 10:54am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/6 "2020-03-17T10:54:34Z")
Ok so, if your message is a perfect json, try this:
```
input {
stdin{}
}
filter {
json {
source => "message"
}
}
output {
stdout{}
}
```
You should get something like the following:
```
{
"LastDate" => "14/03/2020 11:42:09",
"tenantID" => 81183,
"FirstDate" => "14/03/2020 07:12:18",
"message" => "{\"tenantID\": 81183, \"Size\": 8.54, \"FirstDate\": \"14/03/2020 07:12:18\", \"LastDate\": \"14/03/2020 11:42:09\"}",
"Size" => 8.54
}
```
_ **NOTE** : obviously I meant the filter section, that one is the exact pipeline I used to test your input, setting as input_ `{"tenantID": 81183, "Size": 8.54, "FirstDate": "14/03/2020 07:12:18", "LastDate": "14/03/2020 11:42:09"}`
---
### Author:  [@Ramon\_Mateo](https://discuss.elastic.co/u/Ramon_Mateo)
#### Post date: [March 17, 2020, 11:28am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/7 "2020-03-17T11:28:34Z")
It works, thanks!!!! 😠😠ðŸ˜
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 17, 2020, 11:40am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/8 "2020-03-17T11:40:43Z")
No problem. I only ask you to mark my answer as a solution, so future readers will see this thread has been solved.
Thanks.
---
### Author:  [@Ramon\_Mateo](https://discuss.elastic.co/u/Ramon_Mateo)
#### Post date: [March 17, 2020, 11:42am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/9 "2020-03-17T11:42:26Z")
Do it. Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 14, 2020, 11:42am UTC](https://discuss.elastic.co/t/how-can-i-filter-this-pattern/223885/10 "2020-04-14T11:42:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.