# How to extract data from this pattern, with grok filter its not working

**URL:** https://discuss.elastic.co/t/how-to-extract-data-from-this-pattern-with-grok-filter-its-not-working/148486
**Category:** Logstash
**Created:** [September 13, 2018, 5:17pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-this-pattern-with-grok-filter-its-not-working/148486 "2018-09-13T17:17:11Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)
#### Post date: [September 13, 2018, 5:17pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-this-pattern-with-grok-filter-its-not-working/148486/1 "2018-09-13T17:17:12Z")

</div>

How to extract data from this pattern, with grok filter its not working

below data is available in log file

> logEvent": {  
> "message": "JDBC - Exception. Not retrying. event: "{"LastModifiedDate":"2018-09-12T18:19:15.000Z","Ownership":"Public","Website":"[http://www.uos.com](http://www.uos.com)","NumberOfEmployees":24000"}

I need to extract column/event name as "NumberOfEmployees"

NumberOfEmployees : 24000

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 17, 2018, 4:50pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-this-pattern-with-grok-filter-its-not-working/148486/2 "2018-09-17T16:50:46Z")

</div>

Since you didn't post the log snippet as preformatted text it has been mangled so it's not clear exactly what it looks like. But it seems to be JSON, in which case you should use a json filter to parse it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2018, 4:50pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-this-pattern-with-grok-filter-its-not-working/148486/3 "2018-10-15T16:50:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
