# How to multi grok json with pipe
**URL:** https://discuss.elastic.co/t/how-to-multi-grok-json-with-pipe/167296
**Category:** Logstash
**Created:** [February 6, 2019, 1:58pm UTC](https://discuss.elastic.co/t/how-to-multi-grok-json-with-pipe/167296 "2019-02-06T13:58:24Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@BBStash](https://discuss.elastic.co/u/BBStash)
#### Post date: [February 6, 2019, 1:58pm UTC](https://discuss.elastic.co/t/how-to-multi-grok-json-with-pipe/167296/1 "2019-02-06T13:58:24Z")
Hi
How to grok this in logstash:
{"data":{"context":{"code":39921,"father\_pid":"20190204171709\_eIqUa","origin":"tWarn\_1","context":"Default","project":"DATA\_RECOVERY","pid":"8ccIjj","job":"FR\_SIUV1\_Load\_MyJob","priority":3,"type":"tWarn","message":"2019-02-06 17:19:20|ST1\_GINKGONE\_ZON|begin||\nProcessing archive/data/runSIUV1\_Load\_MyJob/data/03-in/In/OGEO\_ZON.zip, please wait...\n\n\nProcess finished\nPrepare json schema for id: ST1\_GINKGONE\_ZON.tJSONDocOpen\_1\nPrepare json schema for id: ST1\_GINKGONE\_ZON.tJSONDocOpen\_2\nPrepare json schema for id: ST2\_GINKGONE\_ZON.tJSONDocOpen\_2\n2019-02-06 17:19:23|ST1\_GINKGONE\_ZON|end|success|3215","root\_pid":"20190204171709\_eIqUa","moment":"2019-02-06 17:19:23"},"content":{"message":"Information tWarn\_1"}},"header":{"logType":"technical","level":"info","sourceHost":"","logVersion":"","contentType":"application/json","version":"0.1","timestamp":"2019-02-06T17:19:23.236+0100"}}
A simple json filter gave me this:
2019-02-04 17:57:48|JOB\_NAME\_HAB|begin||
Processing archive/data/runSIUV1\_Load\_MyJob/data/03-in/In/QLHB\_HAB.zip, please wait...
Process finished
Prepare json schema for id: JOB\_NAME\_HAB.tJSONDocOpen\_2
Prepare json schema for id: JOB\_NAME\_HAB.tJSONDocOpen\_3
Prepare json schema for id: ST2\_GINKGO\_HAB.tJSONDocOpen\_1
2019-02-04 17:58:06|JOB\_NAME\_HAB|end|success|17870
I want to parse other piped fields like status ==\> success and duration ==\> 17870
Thanks
B.B
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 6, 2019, 3:43pm UTC](https://discuss.elastic.co/t/how-to-multi-grok-json-with-pipe/167296/2 "2019-02-06T15:43:59Z")
I would use grok. You need to identify a pattern that you can extract from the message. There are hundreds of examples in this forum.
```
grok { match => { "[data][context][message]" => ["\|end\|(?[^|]+)\|(?[^|]+)$" ] } }
```
---
### Author:  [@BBStash](https://discuss.elastic.co/u/BBStash)
#### Post date: [February 7, 2019, 3:23pm UTC](https://discuss.elastic.co/t/how-to-multi-grok-json-with-pipe/167296/3 "2019-02-07T15:23:18Z")
Thank you, it's OK.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 7, 2019, 3:23pm UTC](https://discuss.elastic.co/t/how-to-multi-grok-json-with-pipe/167296/4 "2019-03-07T15:23:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.