# How to extract partial match using grok filtering?

**URL:** <https://discuss.elastic.co/t/how-to-extract-partial-match-using-grok-filtering/105649>\
**Category:** Logstash\
**Created:** [October 29, 2017, 2:00am UTC](https://discuss.elastic.co/t/how-to-extract-partial-match-using-grok-filtering/105649 "2017-10-29T02:00:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AI\_Rumman](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@AI\_Rumman](https://discuss.elastic.co/u/AI_Rumman)\
**Post date:** [October 29, 2017, 2:00am UTC](https://discuss.elastic.co/t/how-to-extract-partial-match-using-grok-filtering/105649/1 "2017-10-29T02:00:31Z")

</div>

Hi,  
I am trying to write a logstash conf file with grok filter to find out my cassandra clusters name and datacenter name.

For example: Initial value:  
`"metric_path": "zabbix_test-us-east-2-node0.KeyCache.HitRate"`  
Here,

```
Cluster Name = zabbix_test
Datacenter Name = us-east-2

```

So my naming convention is:

`<cluster_name>-<datacenter name>-node<Number>`  
So far, I am able to find our instance name using this:

```
filter {
   grok {
     match => { "metric_path" => "(?<instance_name>[^.]*)" }
   }
}

```

Can someone please tell me how to extract datacenter name and cluster name from the string?  
For example:  
datacenter name = us-west-1  
cluster name = zabbix\_text

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 30, 2017, 12:45pm UTC](https://discuss.elastic.co/t/how-to-extract-partial-match-using-grok-filtering/105649/2 "2017-10-30T12:45:11Z")

</div>

```
(?<cluster>[^-]+)-%{GREEDYDATA:datacenter}-node\d+
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2017, 12:45pm UTC](https://discuss.elastic.co/t/how-to-extract-partial-match-using-grok-filtering/105649/3 "2017-11-27T12:45:13Z")

</div>

Closed on November 27, 2017, 12:45pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.