# How to grok pattern match middle of a string?

**URL:** <https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708>\
**Category:** Logstash\
**Created:** [June 23, 2021, 12:47am UTC](https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708 "2021-06-23T00:47:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohsin106](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohsin106/32/65203_2.png) [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Post date:** [June 23, 2021, 12:47am UTC](https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708/1 "2021-06-23T00:47:36Z")

</div>

I have a string that looks like this:

> SITE;500400;PEER FLOW (AS 3535);;100G;MR;PP:10.02.01.91 97,98;

I just want to extract "FLOW" into a field named peer.

I tried doing this:

```auto
(?<peer>\w+\D\d+\D\w+\s(\w+))

```

But that gives me:

> {"peer": "SITE;500400;PEER FLOW"}

Is it also possible to extract "10.02.01.91" and join it with "FLOW" so that "FLOW 10.02.01.91" can be assigned to peer?

---

<div class="post-metadata">

**Author:** ![mohsin106](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohsin106/32/65203_2.png) [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Post date:** [June 23, 2021, 1:11am UTC](https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708/2 "2021-06-23T01:11:10Z")

</div>

I think I figured out the first part. The following gives me "FLOW" assigned to a field named peer:

```auto
%{WORD:sitename}\D(?<number>\d+)\D\w+\s(?<peer>\w+) 

```

Output:

```auto
{
  "sitename": "SITE",
  "number": "500400",
  "peer": "FLOW"
}

```

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [June 25, 2021, 4:51pm UTC](https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708/3 "2021-06-25T16:51:04Z")

</div>

Hi,

Multiple possibilities, two example here:

- This one is a pattern for the whole line  
`%{DATA};%{DATA};%{WORD}\s%{WORD:peer}%{DATA};%{DATA};%{DATA};%{DATA};%{DATA}%{IP:ip}%{DATA};`
- This one is a patter just for the informations you want  
`%{DATA};%{DATA};%{WORD}\s%{WORD:peer}.*%{IP:ip}`

Cad.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2021, 4:51pm UTC](https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708/4 "2021-07-23T16:51:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.