How to grok pattern match middle of a string?

[mohsin106 (Mohsin)]

I have a string that looks like this:

SITE;500400;PEER FLOW (AS 3535);;100G;MR;PP:10.02.01.91 97,98;

I just want to extract "FLOW" into a field named peer.

I tried doing this:

(?<peer>\w+\D\d+\D\w+\s(\w+))

But that gives me:

{"peer": "SITE;500400;PEER FLOW"}

Is it also possible to extract "10.02.01.91" and join it with "FLOW" so that "FLOW 10.02.01.91" can be assigned to peer?

[mohsin106 (Mohsin)]

I think I figured out the first part. The following gives me "FLOW" assigned to a field named peer:

%{WORD:sitename}\D(?<number>\d+)\D\w+\s(?<peer>\w+) 

Output:

{
  "sitename": "SITE",
  "number": "500400",
  "peer": "FLOW"
}

[Cad]

Hi,

Multiple possibilities, two example here:

• This one is a pattern for the whole line
  %{DATA};%{DATA};%{WORD}\s%{WORD:peer}%{DATA};%{DATA};%{DATA};%{DATA};%{DATA}%{IP:ip}%{DATA};
• This one is a patter just for the informations you want
  %{DATA};%{DATA};%{WORD}\s%{WORD:peer}.*%{IP:ip}

Cad.