How to grok pattern match middle of a string?

I have a string that looks like this:

SITE;500400;PEER FLOW (AS 3535);;100G;MR;PP: 97,98;

I just want to extract "FLOW" into a field named peer.

I tried doing this:


But that gives me:

{"peer": "SITE;500400;PEER FLOW"}

Is it also possible to extract "" and join it with "FLOW" so that "FLOW" can be assigned to peer?

I think I figured out the first part. The following gives me "FLOW" assigned to a field named peer:



  "sitename": "SITE",
  "number": "500400",
  "peer": "FLOW"


Multiple possibilities, two example here:

  • This one is a pattern for the whole line
  • This one is a patter just for the informations you want


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.