# How to extract the data?

**URL:** <https://discuss.elastic.co/t/how-to-extract-the-data/178148>\
**Category:** Logstash\
**Created:** [April 24, 2019, 4:47am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148 "2019-04-24T04:47:27Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuva\_rajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuva_rajan/32/44683_2.png) [@yuva\_rajan](https://discuss.elastic.co/u/yuva_rajan)\
**Post date:** [April 24, 2019, 4:47am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/1 "2019-04-24T04:47:28Z")

</div>

# Below is the data in json 👎

{  
"\_source": {  
"notification": {  
""eventDescription": "[Monitored alert priority \>=4] [\*\*\*] [https://\*\*\*] [The application powershell.exe is executing a fileless script or command.] [Incident id: \*\*\*] [Threat score: 4] [Group: \*\*\*\*\*\*] [Email: \*\*\*\*] [Name: \*\*\*\*\*\*] [Type and OS: WINDOWS Windows 10 x64] [Severity: Monitored]\n","  
}  
}  
}

I want parse the data of eventDescription field. Help is needed.

---

<div class="post-metadata">

**Author:** ![Gomathi\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gomathi_meena/32/43086_2.png) [@Gomathi\_Meena](https://discuss.elastic.co/u/Gomathi_Meena)\
**Post date:** [April 24, 2019, 5:10am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/2 "2019-04-24T05:10:42Z")

</div>

From where you wanted to parse the data ? Can you mention it little bit clearly ..Are you trying to parse the data from elasticsearch to somewhere else ??

---

<div class="post-metadata">

**Author:** ![yuva\_rajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuva_rajan/32/44683_2.png) [@yuva\_rajan](https://discuss.elastic.co/u/yuva_rajan)\
**Post date:** [April 24, 2019, 5:31am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/3 "2019-04-24T05:31:34Z")

</div>

Hi,

From logstash.

---

<div class="post-metadata">

**Author:** ![Gomathi\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gomathi_meena/32/43086_2.png) [@Gomathi\_Meena](https://discuss.elastic.co/u/Gomathi_Meena)\
**Post date:** [April 24, 2019, 5:41am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/4 "2019-04-24T05:41:16Z")

</div>

You can use the kv filter's include\_keys option to parse only the particular field from logstash to elastic search .  
refer :[https://www.elastic.co/guide/en/logstash/6.5/plugins-filters-kv.html](https://www.elastic.co/guide/en/logstash/6.5/plugins-filters-kv.html)  
Hope it helps.

---

<div class="post-metadata">

**Author:** ![yuva\_rajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuva_rajan/32/44683_2.png) [@yuva\_rajan](https://discuss.elastic.co/u/yuva_rajan)\
**Post date:** [April 24, 2019, 9:14am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/5 "2019-04-24T09:14:53Z")

</div>

@Gmoathi.. Didnt work..

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 24, 2019, 1:30pm UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/6 "2019-04-24T13:30:47Z")

</div>

The message is delimited using [and], so I would use a [dissect](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) filter for that.

---

<div class="post-metadata">

**Author:** ![yuva\_rajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuva_rajan/32/44683_2.png) [@yuva\_rajan](https://discuss.elastic.co/u/yuva_rajan)\
**Post date:** [April 25, 2019, 9:11am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/7 "2019-04-25T09:11:48Z")

</div>

> [@Badger](#):
>
> dissect

@Badger, i will check and get back to you

---

<div class="post-metadata">

**Author:** ![yuva\_rajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuva_rajan/32/44683_2.png) [@yuva\_rajan](https://discuss.elastic.co/u/yuva_rajan)\
**Post date:** [April 27, 2019, 10:47am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/8 "2019-04-27T10:47:34Z")

</div>

dissect filter helps me to extract it..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2019, 10:47am UTC](https://discuss.elastic.co/t/how-to-extract-the-data/178148/9 "2019-05-25T10:47:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.