# How can i parse the following in logstash

**URL:** <https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797>\
**Category:** Logstash\
**Created:** [May 26, 2019, 11:48am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797 "2019-05-26T11:48:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [May 26, 2019, 11:48am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/1 "2019-05-26T11:48:15Z")

</div>

```
    1st candidate: 9892143415 is the ph. no.
    2nd candidate: my phone no. is 8976635405
    3rd candidate: hii all 8976547545 my phone no.

```

Likewise i have 100 candidates and all have wriiten their phone no. in different positions . How can i extract only the phone no.s without using 100 parsers .

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 26, 2019, 12:18pm UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/2 "2019-05-26T12:18:52Z")

</div>

You could match a group of digits surrounded by white space or end of line...

```
grok { match => { "message" => "(^|\s)(?<phone>\d{10})($|\s)" } }
```

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [May 26, 2019, 1:16pm UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/3 "2019-05-26T13:16:08Z")

</div>

@Vishnu_mk you can try this grok  
%{GREEDYDATA:candidate\_name}:%{GREEDYDATA:data1}%{NUMBER:phone\_number}%{GREEDYDATA:data2}

---

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [May 26, 2019, 3:01pm UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/4 "2019-05-26T15:01:27Z")

</div>

Thanks Badger

---

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [May 27, 2019, 5:55am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/5 "2019-05-27T05:55:07Z")

</div>

Hii,  
I am creating a pipeline . because the candidate details are in (.docx) format and i have used fscrawler to send it to elasticsearch. It has being successfully indexed to elasticsearch . But now i am trying to parse the details using pipiline

```
PUT _ingest/pipeline/demo3
{
  "description" : "fscrawler demo3",
  "processors" : [
    {
      "grok": { 
        "field": "content", 
          "patterns": ["(^|\s)(?<phone>\d{10})($|\s)"] 
        }
 
    }
  ]
}

```

When i am writing this pipeline in devtool it is giving me Bad string fin the pattern part

---

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [May 27, 2019, 6:12am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/6 "2019-05-27T06:12:38Z")

</div>

Its giving me Unrecognized character escape 's'

---

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [May 27, 2019, 8:05am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/7 "2019-05-27T08:05:29Z")

</div>

It is running now by changing:

```auto
(^|\s)(?<phone>\d{10})($|\s)

```

to  
`(^|\\s)(?<phone>\\d{10})($|\\s)`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2019, 8:05am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-following-in-logstash/182797/8 "2019-06-24T08:05:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.