# How to parse particular text string from logs and send to index? **URL:** \ **Category:** Logstash\ **Created:** [April 27, 2017, 10:57am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842 "2017-04-27T10:57:07Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![virendra\_oswal](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Post date:** [April 27, 2017, 10:57am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/1 "2017-04-27T10:57:07Z")
This is my current configuration in logstash configuration: Logstash Configuration: > input { > beats { > port =\> 5044 > } > } > output { > elasticsearch { > hosts =\> ["[http://localhost:9200/](http://localhost:9200/)"] > } > stdout { > codec =\> rubydebug > } > } I am able to get logs via Filebeats from my application server. Usecase: 1. Find all logs for text "Rest API call" 2. Write to index in elastic-search 3. And create date wise visualization in kibana. Not sure how to use Filter tags . ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 28, 2017, 6:16am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/3 "2017-04-28T06:16:24Z")
You can e.g. use a conditional in your filter section to selectively drop events that don't match the desired pattern. ```nohighlight filter { if [message] !~ /REST API call/ { drop { } } } ``` [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) ---
**Author:** ![virendra\_oswal](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Post date:** [April 28, 2017, 6:24am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/4 "2017-04-28T06:24:23Z")
do i need to write anything inside drop {} ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 28, 2017, 6:25am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/5 "2017-04-28T06:25:06Z")
No, you don't. ---
**Author:** ![virendra\_oswal](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Post date:** [April 28, 2017, 6:27am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/6 "2017-04-28T06:27:45Z")
that was total perfect one! Thanks ---
**Author:** ![virendra\_oswal](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Post date:** [April 28, 2017, 7:15am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/7 "2017-04-28T07:15:23Z")
one more thing from filter i got data, there is one "message" key. I want to extract each value from message and pass to index in Elasticsearch. Message is of format: > [2017-04-26 07:32:10,673] req#502bf179-49a5-4604-aae0-a7a85607ec30~@ClassName#Class-Method-Name INFO [[ACTIVE] ExecuteThread: '13' for queue: 'weblogic.kernel.Default (self-tuning)'](java class qualified name) - **Calling REST API** \*\* http-based-rest-call I want to extract http call, User and timestamp ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 28, 2017, 7:21am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/8 "2017-04-28T07:21:54Z")
Use a grok filter for that. ---
**Author:** ![virendra\_oswal](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Post date:** [April 28, 2017, 7:26am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/9 "2017-04-28T07:26:04Z")
grok filter needs to given all values or placeholder, cant i just extract required values ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 28, 2017, 7:31am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/10 "2017-04-28T07:31:00Z")
I'm not sure what you're asking. You can extract any parts of the string to new fields. ---
**Author:** ![virendra\_oswal](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Post date:** [April 28, 2017, 7:33am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/11 "2017-04-28T07:33:22Z")
is just extracting http request possible ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 28, 2017, 7:39am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/12 "2017-04-28T07:39:18Z")
I said: You can extract any parts of the string to new fields. That means you can extract the HTTP request. If you're not familiar with regular expressions the grok constructor web site might be useful. ---
**Author:** ![virendra\_oswal](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Post date:** [April 28, 2017, 9:52am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/13 "2017-04-28T09:52:12Z")
Can you help on this [Timestamp not getting my log value using date filter logstash](https://discuss.elastic.co/t/timestamp-not-get-my-log-value/83993) i was able to get request but timestamp is not getting overriden with log date ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 26, 2017, 9:56am UTC](https://discuss.elastic.co/t/how-to-parse-particular-text-string-from-logs-and-send-to-index/83842/14 "2017-05-26T09:56:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.