# How to get only matched lines from "Message"?
**URL:** https://discuss.elastic.co/t/how-to-get-only-matched-lines-from-message/129989
**Category:** Logstash
**Created:** [April 30, 2018, 6:48am UTC](https://discuss.elastic.co/t/how-to-get-only-matched-lines-from-message/129989 "2018-04-30T06:48:43Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 30, 2018, 6:48am UTC](https://discuss.elastic.co/t/how-to-get-only-matched-lines-from-message/129989/1 "2018-04-30T06:48:43Z")
Hi, I am using grok filter to find match, lines in "message",But i not getting how to get that lines from "message".
Here is my filter
grok
{
match =\> { logs =\> "dhd\_check\_hang: Event HANG send up due to"}
}
And here is input
rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
[15119.753902] Dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
[15119.753917] Dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
[15119.753937] Dhd\_prot\_ioctl : bus is down. we have nothing to do
[15119.791431] [] (schedule\_timeout+0x158/0x25c) from [] (0xea1e0000)
[15119.799331] kworker/3:2 R running 0 29597 2 0x00000000
[15119.805699] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.814384] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.822637] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.830710] kworker/u8:1 S c0ab2fd4 0 29738 2 0x00000000
[15119.837078] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.845763] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.854015] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.862088] kworker/u8:4 S c0ab2fd4 0 29739 2 0x00000000
[15119.868455] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.877140] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.885391] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.893468] Sched Debug Version: v0.10, 3.10.96+ #1
[15119.898337] ktime
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [April 30, 2018, 10:04pm UTC](https://discuss.elastic.co/t/how-to-get-only-matched-lines-from-message/129989/2 "2018-04-30T22:04:08Z")
grok isn't really for finding matches; it's for extracting structured information from flat messages.
If you merely want to select messages that match a pattern, you can use an `if` statement:
```auto
filter {
if [message] =~ /Dhd_check_hang/ {
# filters in here will only run on messages that match the pattern
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 28, 2018, 10:04pm UTC](https://discuss.elastic.co/t/how-to-get-only-matched-lines-from-message/129989/3 "2018-05-28T22:04:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.