# How obtain only a part of the log?

**URL:** https://discuss.elastic.co/t/how-obtain-only-a-part-of-the-log/166042
**Category:** Logstash
**Created:** [January 28, 2019, 7:46pm UTC](https://discuss.elastic.co/t/how-obtain-only-a-part-of-the-log/166042 "2019-01-28T19:46:39Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Lucas\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@Lucas\_Fernandez](https://discuss.elastic.co/u/Lucas_Fernandez)
#### Post date: [January 28, 2019, 7:46pm UTC](https://discuss.elastic.co/t/how-obtain-only-a-part-of-the-log/166042/1 "2019-01-28T19:46:39Z")

</div>

Hello! I only want know, how to get only a part of log string.  
My input is from filebeat and my output is elasticseach base.

I have this logstash.conf

input {  
beats {  
port =\> 5044  
}  
}

filter {  
grok {  
match =\> {  
"message" =\> "%{{.\*}$:contrato}"  
}  
add\_field =\> { "contrato" =\> "%{contrato}" }  
}  
}

output {  
elasticsearch {  
hosts =\> ["elasticsearch:9200"]  
index =\> "logstash"  
}  
stdout {  
codec =\> json  
}  
}

and this is my log string

DEBUG [2019-01-25 18:18:35,973] db679d09-66d1-4556-90d0-6174dc4b90ce a.c.e.s.j.c.JudicialidadService [dw-21 - GET /siniestros?expedientes=254472] {contrato:12345}

i want add a field named: contrato\_field and the value of contrato\_field = 12345

how i have to do it??

thank everyone!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 28, 2019, 8:25pm UTC](https://discuss.elastic.co/t/how-obtain-only-a-part-of-the-log/166042/2 "2019-01-28T20:25:52Z")

</div>

```
grok { match => { "message" => ["{contrato:%{INT:contrato_field:int}}"] } }
```

---

<div class="post-metadata">

### Author: ![Lucas\_Fernandez](https://avatars.discourse-cdn.com/v4/letter/l/54ee81/32.png) [@Lucas\_Fernandez](https://discuss.elastic.co/u/Lucas_Fernandez)
#### Post date: [January 29, 2019, 1:36pm UTC](https://discuss.elastic.co/t/how-obtain-only-a-part-of-the-log/166042/3 "2019-01-29T13:36:41Z")

</div>

Its work, thank you very much!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 26, 2019, 1:36pm UTC](https://discuss.elastic.co/t/how-obtain-only-a-part-of-the-log/166042/4 "2019-02-26T13:36:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.