# How to grep number

**URL:** <https://discuss.elastic.co/t/how-to-grep-number/89696>\
**Category:** Kibana\
**Created:** [June 16, 2017, 11:19am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696 "2017-06-16T11:19:02Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aris\_Pratama](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Aris\_Pratama](https://discuss.elastic.co/u/Aris_Pratama)\
**Post date:** [June 16, 2017, 11:19am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/1 "2017-06-16T11:19:02Z")

</div>

hey all,

i have log message:

Jun 16 18:09:12 mail postfix/qmgr[30910]: 63F9C18BE69: from=[root@test.srv](mailto:root@test.srv), size=1116, nrcpt=1 (queue active)

but i only want to grep the number after word "size=" , is there any solution how to grep the number?

and i want to create visualize the number after word "size=" , can anyone give me solution?

thanks 🙂

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [June 17, 2017, 6:17am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/2 "2017-06-17T06:17:38Z")

</div>

what are you using to parse this ? logstash ? something else ?

for logstash grok you can get docs here: [https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-grok.html)

something like this might work:

`%{SYSLOGBASE} %{WORD:queue_id}: from=%{EMAILADDRESS:from}, size={NUMBER:size}, ncrpt={nUMBER:ncrpt)`

---

<div class="post-metadata">

**Author:** ![Aris\_Pratama](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Aris\_Pratama](https://discuss.elastic.co/u/Aris_Pratama)\
**Post date:** [June 19, 2017, 2:11am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/3 "2017-06-19T02:11:38Z")

</div>

oh, sorry for not inform you.

i'm using filebeat direct to elasticsearch.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 19, 2017, 3:00am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/4 "2017-06-19T03:00:54Z")

</div>

Then you need to use the ingest API or use Logstash, ES cannot do this.

---

<div class="post-metadata">

**Author:** ![Aris\_Pratama](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Aris\_Pratama](https://discuss.elastic.co/u/Aris_Pratama)\
**Post date:** [June 19, 2017, 3:15am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/5 "2017-06-19T03:15:23Z")

</div>

thanks for the answer @warkolm

so, if i want to create visualize using the number after word "size=" must using logstash or ingest API? can't directly from filebeat to elasticsearch?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 19, 2017, 3:20am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/6 "2017-06-19T03:20:28Z")

</div>

FB does not parse these types of events, so yes you do need something else to do it.

---

<div class="post-metadata">

**Author:** ![Aris\_Pratama](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Aris\_Pratama](https://discuss.elastic.co/u/Aris_Pratama)\
**Post date:** [June 19, 2017, 3:42am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/7 "2017-06-19T03:42:10Z")

</div>

thanks @warkolm,

can you suggest me what to use? so i can create visualize kibana using the number after word "size=" .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2017, 3:42am UTC](https://discuss.elastic.co/t/how-to-grep-number/89696/8 "2017-07-17T03:42:32Z")

</div>

Closed on July 17, 2017, 3:42am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.