# How to make it work?!
**URL:** https://discuss.elastic.co/t/how-to-make-it-work/270534
**Category:** Logstash
**Created:** [April 19, 2021, 5:30am UTC](https://discuss.elastic.co/t/how-to-make-it-work/270534 "2021-04-19T05:30:35Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@tennaen](https://discuss.elastic.co/u/tennaen)
#### Post date: [April 19, 2021, 5:30am UTC](https://discuss.elastic.co/t/how-to-make-it-work/270534/1 "2021-04-19T05:30:35Z")
Dears,
i have a problem and i cannot deal with it. In my pipeline configuration i have this code:
```auto
if "%{[process][thread][id]}" =~ "[a-z0-9]+/[a-z0-9]+" {
mutate {
split => {
"[process][thread][id]" => "/"
}
add_field => {
"[event][trace][id]" => "%{[process][thread][id][0]}"
"[event][span][id]" => "%{[process][thread][id][1]}"
}
}
}
```
This is another variation of mutate filter and this one isn't working at all.
What i want to attainted is to filter all messages not like this [/]
My grok filter:
```auto
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:[timestamp]} \[%{NOTSPACE:[process][thread][id]}\] %{SPACE}?%{LOGLEVEL:[log][level]} %{NOTSPACE:[event][class]}: - %{GREEDYDATA:[event][message]}"
]
}
}
```
Any help will be appreciated.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 19, 2021, 2:49pm UTC](https://discuss.elastic.co/t/how-to-make-it-work/270534/2 "2021-04-19T14:49:27Z")
> [@tennaen](#):
>
> `if "%{[process][thread][id]}" =~`
That should be
```
if [process][thread][id] =~
```
---
### Author:  [@tennaen](https://discuss.elastic.co/u/tennaen)
#### Post date: [April 19, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-make-it-work/270534/3 "2021-04-19T14:58:43Z")
@Badger looks like it's working. Thank you good Sir. I will test it on other indicies and will mark this as solved.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-make-it-work/270534/4 "2021-05-17T14:58:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.