# How to parse out logs based on a hostname

**URL:** <https://discuss.elastic.co/t/how-to-parse-out-logs-based-on-a-hostname/199841>\
**Category:** Logstash\
**Created:** [September 17, 2019, 2:43pm UTC](https://discuss.elastic.co/t/how-to-parse-out-logs-based-on-a-hostname/199841 "2019-09-17T14:43:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![habi](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@habi](https://discuss.elastic.co/u/habi)\
**Post date:** [September 17, 2019, 2:43pm UTC](https://discuss.elastic.co/t/how-to-parse-out-logs-based-on-a-hostname/199841/1 "2019-09-17T14:43:39Z")

</div>

hi i am trying to parse out nginx logs based on a specific hostname and apply`grep` to those logs  
and send the output to a seperate file and i was thinking of using bash scripting for this. I would like to know how can i insert a bash scripting inside the grok expression.  
here is the sample log:  
1.1.1.1 2.2.2.2 - - [17/Sep/2019:13:55:48 +0000] "GET /search&search\_term=elastic+logstash+kibana+md&lat=0.000000000&lng=-0.0000000 HTTP/1.0" 302 328 "[abc.com](http://abc.com)" "-" "" "-" - 0.054 0.056 . - 127.0.0.1:1234

and here is the sample grok expression i use:  
input { stdin { } }

```
filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
  }
  
}

output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

```

i was thinking if i can use the if statement after the match and try to send it to the other folder if or if any other language if i need to use. Thanks

---

<div class="post-metadata">

**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\
**Post date:** [September 18, 2019, 5:44am UTC](https://discuss.elastic.co/t/how-to-parse-out-logs-based-on-a-hostname/199841/2 "2019-09-18T05:44:10Z")

</div>

I do not really understand what you mean, but you can change the output via a field name:  
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-file.html#plugins-outputs-file-path](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-file.html#plugins-outputs-file-path)

So if you want to seperate the output into dedicated files for each hosts you can use the fileoutput.  
If you need more separation you can use if-statements in the output too.

like:

> ```
> output {
> if [hosts] {
> elasticsearch { hosts => ["localhost:9200"] }
> }
> if "somestring" in [field] {
> stdout { codec => rubydebug }
> }
> }
> 
> ```

Hope this helps you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2019, 5:44am UTC](https://discuss.elastic.co/t/how-to-parse-out-logs-based-on-a-hostname/199841/3 "2019-10-16T05:44:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.