,,0,6,,,,,,,,,9004
```
Here is the filter i built:
```auto
input {
file {
path => ["/etc/filebeat/dhcp/test.log"]
add_field => { "testvalue" => "Shipped with logstash :)" }
start_position => "beginning"
}
}
filter {
grok{
match => { "message" => "%{code} %{DATE} %{TIME} %{EVENT} %{IP} %{NAME}" }
}
if "DNS" in [EVENT] {
drop {
}
}
}
output {
elasticsearch {
hosts => "https://elasticsearch:9200"
cacert => '/ca.crt'
user => 'logstash'
password => ?
index => "logstash-%{+yyyy.MM.dd}-dhcp"
}
}
```
I would like to filter the log lines in a way, in which it is represented as:
```auto
Code: x
Date: x
Time: x
IP: x
Name: x
```
Because currently it is one line(1:1 the same line as in the log file), which makes it hard to filter and work with
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [May 12, 2022, 8:23am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/2 "2022-05-12T08:23:12Z")
Make your life easier, use csv filter plugin.
---
### Author:  [@ibra\_013](https://discuss.elastic.co/u/ibra_013)
#### Post date: [May 12, 2022, 8:32am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/3 "2022-05-12T08:32:10Z")
Hi,
It will be like this using Grok, but there is other options like dissect or csv
this [link](https://grokdebug.herokuapp.com/) is your friend for grok.
```auto
filter {
grok{
match => { "message" => "%{NUMBER:code},%{DATE:Date},%{TIME:Time},%{DATA:EVENT},%{IP:Ip},%{WORD:NAME},%{GREEDYDATA:Rest}" }
}
if "DNS" in [EVENT] {
drop {
}
}
}
```
---
### Author:  [@smam](https://discuss.elastic.co/u/smam)
#### Post date: [May 12, 2022, 8:39am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/4 "2022-05-12T08:39:32Z")
Hello, thank you. The pattern you provided "does not match the input data" but I got a feeling for how to construct the filter. With you showing me to assign Datatypes and seperate them by, in this case, ",". I will now try to make it work and then see if the csv filter makes it easier. Thank you!
---
### Author:  [@ibra\_013](https://discuss.elastic.co/u/ibra_013)
#### Post date: [May 12, 2022, 8:42am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/5 "2022-05-12T08:42:06Z")
Hi,
in what does not match the input data?
---
### Author:  [@smam](https://discuss.elastic.co/u/smam)
#### Post date: [May 12, 2022, 8:44am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/6 "2022-05-12T08:44:14Z")
If I paste the lines into "Sample data" and your filter into "Grok Pattern":
After clicking "Simulate" I get a pop-up saying: Provided Grok patterns do not match data in the input
---
### Author:  [@ibra\_013](https://discuss.elastic.co/u/ibra_013)
#### Post date: [May 12, 2022, 8:47am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/7 "2022-05-12T08:47:41Z")
Hi,
i used this input data ;
```auto
30,05/10/22,07:30:27,DNS Update Request,10.0.0.0,user,,0,6,,,,,,,,,0
```
---
### Author:  [@smam](https://discuss.elastic.co/u/smam)
#### Post date: [May 12, 2022, 8:56am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/8 "2022-05-12T08:56:08Z")
Hmm strange..I do not know why its working for you and not for me..
Even if I paste your input data, I get the same error
---
### Author:  [@smam](https://discuss.elastic.co/u/smam)
#### Post date: [May 12, 2022, 10:17am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/9 "2022-05-12T10:17:41Z")
This should be right?
---
### Author:  [@ibra\_013](https://discuss.elastic.co/u/ibra_013)
#### Post date: [May 12, 2022, 10:29am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/10 "2022-05-12T10:29:51Z")
Hi,
Grok debugger is used only to check the grok part, what you are trying to do on the screenshot is on the Logstash.
---
### Author:  [@smam](https://discuss.elastic.co/u/smam)
#### Post date: [May 12, 2022, 10:31am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/11 "2022-05-12T10:31:42Z")
I see. I made it work just fine with csv, but I will try to also understand logstash grok filter. Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2022, 10:32am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537/12 "2022-06-09T10:32:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.