# How to filter a line in field

**URL:** <https://discuss.elastic.co/t/how-to-filter-a-line-in-field/193718>\
**Category:** Elasticsearch\
**Created:** [August 5, 2019, 4:53am UTC](https://discuss.elastic.co/t/how-to-filter-a-line-in-field/193718 "2019-08-05T04:53:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Smkumaran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smkumaran/32/51604_2.png) [@Smkumaran](https://discuss.elastic.co/u/Smkumaran)\
**Post date:** [August 5, 2019, 4:53am UTC](https://discuss.elastic.co/t/how-to-filter-a-line-in-field/193718/1 "2019-08-05T04:53:40Z")

</div>

Hello,

In my case, one of the field has following texts:

(connectionIP =RDP) To login [from 08/08/2019 5:30 AM to 09/08/2019 4:00 PM (GMT+8.00) multiple operations].

Can anyone help me to filter inbetween pls ? .

The idea is to calculate duration of the active session wherein highlighted withinin the [brackets].

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 5, 2019, 9:49am UTC](https://discuss.elastic.co/t/how-to-filter-a-line-in-field/193718/2 "2019-08-05T09:49:46Z")

</div>

you have not mentioned whether you are using any tool for ingestion that could do this. You could use elasticsearch for this, by using a [dissect](https://www.elastic.co/guide/en/beats/packetbeat/7.2/dissect.html)/[grok](https://www.elastic.co/guide/en/elasticsearch/reference/7.2/grok-processor.html) processor to split the string in several pieces, then use a [script](https://www.elastic.co/guide/en/elasticsearch/reference/7.2/script-processor.html) processor to calculate the duration.

--Alex

---

<div class="post-metadata">

**Author:** ![Smkumaran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smkumaran/32/51604_2.png) [@Smkumaran](https://discuss.elastic.co/u/Smkumaran)\
**Post date:** [August 6, 2019, 3:18am UTC](https://discuss.elastic.co/t/how-to-filter-a-line-in-field/193718/3 "2019-08-06T03:18:46Z")

</div>

Thanks for your quick response @spinscale.

I am very new to ELK patterns. I've attached sample data. Can you help me to get the Grok Pattern please ?. I tried but not working.

Sample log : "S12345 Selva July Server access for ELK [From 5/08/2019 10:00:00 AM to 10:00:00 PM (GMT+8.00) multiple operations]".

Solution: expecting separate field as logged hours = 12 hours or 720 minutes.

 ![IMG_20190806_111057](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f76bc6ac8258f7e24963b9f1090a573b823fc654.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2019, 3:18am UTC](https://discuss.elastic.co/t/how-to-filter-a-line-in-field/193718/4 "2019-09-03T03:18:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.