# How can I see the full name of protocol in the index?(hyphen problem)

**URL:** <https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994>\
**Category:** Logstash\
**Created:** [November 7, 2019, 5:01pm UTC](https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994 "2019-11-07T17:01:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lilyyy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lilyyy/32/51129_2.png) [@lilyyy](https://discuss.elastic.co/u/lilyyy)\
**Post date:** [November 7, 2019, 5:01pm UTC](https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994/1 "2019-11-07T17:01:23Z")

</div>

Hello.  
I now have an index on elasticsearch after converting the pcap file to json.

One of the protocols has a full name of "s7comm-plus", but only "plus" is visible in the index.

The other protocols look correctly.

My logstash fileter is below.

# Extract innermost network protocol

```
 grok {
     match => {
         "[layers] [frame] [frame_frame_protocols]" => "% {WORD: protocol} $"
     }
 }

```

How can I change the logstash filter or elasticsearch?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 8, 2019, 3:52pm UTC](https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994/2 "2019-11-08T15:52:33Z")

</div>

**Update** : I just realized this is a logstash question and I answered with an Elasticsearch example. The core of it however is still true and you need to change your pattern type. I also moved this to the logstash forum.

Take this example

```auto
POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "_description",
    "processors": [
      {
        "grok": {
          "field": "input",
          "patterns": [
            "%{WORD:output}"
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "input": "s7comm-plus"
      }
    }
  ]
}

```

when running this, you will see that the `output` only contains `s7comm`, as the dash is a word boundary. You could try sth like `USER` instead of `WORD` and see if that works, as that one includes a dash. You could also come up with your own pattern using a better name 🙂

---

<div class="post-metadata">

**Author:** ![lilyyy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lilyyy/32/51129_2.png) [@lilyyy](https://discuss.elastic.co/u/lilyyy)\
**Post date:** [November 21, 2019, 2:03am UTC](https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994/3 "2019-11-21T02:03:32Z")

</div>

Thank you for replying.  
I solved this problem by using 'if' statements in the logstash config file.

Thank you and have a great day 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2019, 2:03am UTC](https://discuss.elastic.co/t/how-can-i-see-the-full-name-of-protocol-in-the-index-hyphen-problem/206994/4 "2019-12-19T02:03:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.