# How to create grok filter based on targeted word in message?

**URL:** <https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686>\
**Category:** Logstash\
**Created:** [August 10, 2019, 3:56am UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686 "2019-08-10T03:56:06Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bob94](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bob94](https://discuss.elastic.co/u/Bob94)\
**Post date:** [August 10, 2019, 3:56am UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/1 "2019-08-10T03:56:06Z")

</div>

Hi guys please verify whether this is the proper way to use grok ?

If "i am happy: true" in [message] {  
grok { match =\> "message" , "%{GREEDYDATA:myfield"}

}

My intension is to create a new field based on spesific string to be selected in message for visualization later.  
Any help is really really appreciated as im still new with this elk! Thanks guys

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 10, 2019, 12:39pm UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/2 "2019-08-10T12:39:49Z")

</div>

The syntax is wrong, it should be

```
grok { match => { "message" => "%{GREEDYDATA:myfield}" } }

```

That said, if you match a field against GREEDYDATA all you are doing is creating a copy of the field, which would be better done using a mutate filter.

---

<div class="post-metadata">

**Author:** ![Bob94](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bob94](https://discuss.elastic.co/u/Bob94)\
**Post date:** [August 11, 2019, 11:15am UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/3 "2019-08-11T11:15:17Z")

</div>

Hi badger,  
Thanks for your response.

For my case i really need to check the message content like if i am so happy: true then create one field for that like myfield or if i am so happy: false then create another field for that..is it possible to check and verify the content inside the [message] to do that ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 11, 2019, 12:20pm UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/4 "2019-08-11T12:20:18Z")

</div>

You could use grok to pull out true/false using

```
grok { match => { "message" => "^i am so happy: %{WORD:happyOrNot}" } }

```

which will get you

```
"happyOrNot" => "true",

```

Note that that is a string, not a boolean.

---

<div class="post-metadata">

**Author:** ![Bob94](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bob94](https://discuss.elastic.co/u/Bob94)\
**Post date:** [August 11, 2019, 12:42pm UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/5 "2019-08-11T12:42:17Z")

</div>

Ok note that but is there any logic that i can use like when this string is in [message] then create this field ?

Example ia like

If "i am so happy: true" in [message] {  
mutate { addfield , "myfield"=\> %[message]}  
}

Can i use this way ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 11, 2019, 12:44pm UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/6 "2019-08-11T12:44:50Z")

</div>

> [@Bob94](#):
>
> mutate { addfield , "myfield"=\> %[message]}

You could do that but the syntax is

```
mutate { add_field => { "myfield" => "%{[message]}" } }

```

---

<div class="post-metadata">

**Author:** ![Bob94](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bob94](https://discuss.elastic.co/u/Bob94)\
**Post date:** [August 11, 2019, 1:00pm UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/7 "2019-08-11T13:00:37Z")

</div>

Thanks a lot for the correctioned given!! Really appreciated! I will try to implement in such way and will update here later

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2019, 1:10pm UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-based-on-targeted-word-in-message/194686/8 "2019-09-08T13:10:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.