# How can i parse log file and match specific strings with grok filter
**URL:** https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115
**Category:** Logstash
**Created:** [September 24, 2021, 9:59pm UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115 "2021-09-24T21:59:32Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@hagaluly](https://discuss.elastic.co/u/hagaluly)
#### Post date: [September 24, 2021, 9:59pm UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115/1 "2021-09-24T21:59:32Z")
i have a log that looks like this
```auto
BUILD_DISPLAY_NAME=#998
BUILD_NUMBER=998
JENKINS_URL=https:///jenkins.com
BUILD_ID=998
DEVICE_CRED_PSW=pass
GIT_PREVIOUS_SUCCESSFUL_COMMIT=f847h56934875f6239487562j3498
JOB_BASE_NAME=master
```
i have this configuration within my logstash
```auto
input {
file {
mode => "read"
exit_after_read => true
path => "/data/envVar_regression_builds_210913_135255.log"
start_position => "beginning"
file_chunk_size => 1000000
file_completed_action => "log"
file_completed_log_path => "/var/lib/logstash/logged_file.list"
sincedb_path => "/dev/null"
#ignore_older => "10 m"
}
}
output {
stdout { codec => rubydebug { metadata => true } }
}
```
how can i grab each string (like BUILD\_ID=) and parse it via grok so i can filter its results?
---
### Author:  [@hagaluly](https://discuss.elastic.co/u/hagaluly)
#### Post date: [September 24, 2021, 10:12pm UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115/2 "2021-09-24T22:12:44Z")
tried this without success
```auto
filter {
grok {
match => {
"message" => "BUILD_NUMBER= %{NUMBER:build_number}"
}
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 24, 2021, 11:30pm UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115/3 "2021-09-24T23:30:54Z")
I would break\_on\_match =\> false and an array of patterns. Like [this](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/2).
Your example grok does not match because it expects a space after the =
---
### Author:  [@hagaluly](https://discuss.elastic.co/u/hagaluly)
#### Post date: [September 25, 2021, 7:25am UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115/4 "2021-09-25T07:25:36Z")
still not working
```auto
input {
file {
mode => "read"
exit_after_read => true
path => "/data/envVar_regression_builds_210913_135255.log"
start_position => "beginning"
file_chunk_size => 1000000
file_completed_action => "log"
file_completed_log_path => "/var/lib/logstash/logged_file.list"
sincedb_path => "/dev/null"
#ignore_older => "10 m"
}
}
filter {
grok {
break_on_match => false
match => {
"message" => [
"BUILD_NUMBER=%{NUMBER:build_number}"
]
}
}
}
output {
#elasticsearch {
# hosts => ["10.56.10.152:9200"]
# index => "jenkins_env_vars"
#}
stdout { codec => rubydebug { metadata => true } }
}
```
---
### Author:  [@hagaluly](https://discuss.elastic.co/u/hagaluly)
#### Post date: [October 1, 2021, 9:57pm UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115/5 "2021-10-01T21:57:55Z")
anyone?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 29, 2021, 9:58pm UTC](https://discuss.elastic.co/t/how-can-i-parse-log-file-and-match-specific-strings-with-grok-filter/285115/6 "2021-10-29T21:58:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.