# How to groking and nested output

**URL:** <https://discuss.elastic.co/t/how-to-groking-and-nested-output/217930>\
**Category:** Logstash\
**Created:** [February 5, 2020, 8:51am UTC](https://discuss.elastic.co/t/how-to-groking-and-nested-output/217930 "2020-02-05T08:51:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muhammad\_Ariful\_Isla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammad_ariful_isla/32/55732_2.png) [@Muhammad\_Ariful\_Isla](https://discuss.elastic.co/u/Muhammad_Ariful_Isla)\
**Post date:** [February 5, 2020, 8:51am UTC](https://discuss.elastic.co/t/how-to-groking-and-nested-output/217930/1 "2020-02-05T08:51:14Z")

</div>

Hello,  
I am having a log from a router and I have parsed with grok. But the thing I am struggling with is that I cannot create nested `json` object. For Example,

```
 proto TCP (ACK,FLAG)

```

To perse above log, I have applied following regex,

```
proto[[:blank:]](?<PROTOCOL>TCP|UDP)[[:blank:]](?<FLAG>\([A-Z,]+\))

```

So results are following,

```
  "PROTOCOL": [
    [
      "TCP"
    ]
  ],
  "FLAG": [
    [
      "(ACK,FIN)"
    ]
  ],

```

But how can I achieve something like the following,

```
  "PROTOCOL": [
    [
      "TCP"
    ]
  ],
  "FLAG": [
    [
      "TYPE: ["ACK", "FIN"]
    ]
  ],
```

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [February 5, 2020, 12:20pm UTC](https://discuss.elastic.co/t/how-to-groking-and-nested-output/217930/2 "2020-02-05T12:20:29Z")

</div>

Hi there!

What about doing it in two steps?

```
input { 
  generator { 
    count => 1 
    lines => ['proto TCP (ACK,FLAG)'] 
  } 
}

filter {
  grok {
    match => { "message" => "proto\s+%{WORD:PROTOCOL}\s+\(%{DATA:to_split}\)" }
  }

  ruby {
    code => "
      unless (flags = event.get('to_split')).nil?
        event.set('[FLAG][TYPE]', flags.delete(' ').split(','))
        event.remove('to_split')
      end
    "
  }
}

output {
  stdout{}
}

```

Also, look at my grok filter and take a leaf out of it to improve yours if you want (that `[[:blank:]]` for example is both bulky and dangerous IMO)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 5, 2020, 5:25pm UTC](https://discuss.elastic.co/t/how-to-groking-and-nested-output/217930/3 "2020-02-05T17:25:38Z")

</div>

Use mutate+gsub to remove the parentheses, then use mutate+split to separate the flags, then use mutate+rename to change the name of the field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 5:25pm UTC](https://discuss.elastic.co/t/how-to-groking-and-nested-output/217930/4 "2020-03-04T17:25:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.