# How parse this field Transport: PTU.13-3034-3345-70;
**URL:** https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147
**Category:** Logstash
**Created:** [July 23, 2015, 10:58am UTC](https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147 "2015-07-23T10:58:43Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Smasell](https://discuss.elastic.co/u/Smasell)
#### Post date: [July 23, 2015, 10:58am UTC](https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147/1 "2015-07-23T10:58:43Z")
Hi!!!
How to parse this field? Transport: PTU.13-3034-3345-70; Is it GREEDYDATA?
---
### Author:  [@Junior\_Burleon](https://discuss.elastic.co/u/Junior_Burleon)
#### Post date: [July 23, 2015, 11:48am UTC](https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147/2 "2015-07-23T11:48:41Z")
Which information do you want to get ?
GEEDYDATA is just to get any informations.
For example if you want
```
%{GREEDYDATA:firstInfo}: %{GREEDYDATA:secondInfo}\.%{GREEDYDATA:thirthInfo};
```
Will give you :
```
{
"firstInfo": [
[
"Transport"
]
],
"secondInfo": [
[
"PTU"
]
],
"thirthInfo": [
[
"13-3034-3345-70"
]
]
}
```
For me it's the easiest to use. If you use another it's because you want to get an information to match with a specific regex that already exist.
---
### Author:  [@Smasell](https://discuss.elastic.co/u/Smasell)
#### Post date: [July 23, 2015, 11:54am UTC](https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147/3 "2015-07-23T11:54:30Z")
@Junior_Burleon
All I want is to get field in my documents
"Transport-id" : "PTU.13-3034-3345-70"
my logs looks like this Product: starter pack; Transport: PTU.13-3034-3345-70; User ip: 207.96.147.90; user\_id: 697971; name: 'Herco Diambala';
I use:
grok {
match =\> ["message", "Transport: %{Syntax :transport-id};"]
tag\_on\_failure =\> []
}
but don't know what to use instead syntax?
---
### Author:  [@Junior\_Burleon](https://discuss.elastic.co/u/Junior_Burleon)
#### Post date: [July 23, 2015, 12:03pm UTC](https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147/4 "2015-07-23T12:03:37Z")
I think that you can't use " - " in the name.
One solution is :
```
grok {
match => ["message", "Transport: %{GREEDYDATA:Transport_id}; User"]
tag_on_failure => []
}
```
But I don't know if it's the best way.
I put "; User" at the end of syntaxe, else it will match with the last ";"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 23, 2015, 12:07pm UTC](https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147/5 "2015-07-23T12:07:27Z")
```
%{GREEDYDATA:firstInfo}: %{GREEDYDATA:secondInfo}\.%{GREEDYDATA:thirthInfo};
```
Be very careful about using multiple GREEDYDATA and/or DATA patterns. I've seen a number of cases where people have done this and got really weird results.
In this particular case I'd look into using the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/how-parse-this-field-transport-ptu-13-3034-3345-70/26147/6 "2017-07-06T05:33:57Z")