# How to simplify logic or format code for grok filter?

**URL:** <https://discuss.elastic.co/t/how-to-simplify-logic-or-format-code-for-grok-filter/193696>\
**Category:** Logstash\
**Created:** [August 4, 2019, 11:25pm UTC](https://discuss.elastic.co/t/how-to-simplify-logic-or-format-code-for-grok-filter/193696 "2019-08-04T23:25:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![naveenrt23](https://avatars.discourse-cdn.com/v4/letter/n/47e85d/32.png) [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\
**Post date:** [August 4, 2019, 11:25pm UTC](https://discuss.elastic.co/t/how-to-simplify-logic-or-format-code-for-grok-filter/193696/1 "2019-08-04T23:25:31Z")

</div>

Hello,

I want to find out if there's any way to simplify the below code:

```
filter {
      mutate {
        add_field => {
          "[@metadata][copyOfMessage]" => "%{[message]}"
        }
      }
      mutate {
        split => {
          "[@metadata][copyOfMessage]" => "|"
        }
      }
      if [@metadata][copyOfMessage][4] =~ /^\/test\// {
        grok {
          break_on_match => false
          match => { "message" => "%{DATA:timestamp_local}\|%{NUMBER:duration}\|%{WORD:requesttype}\|%{DATA:username}\|%{DATA:resource}\|%{NUMBER:statuscode}\|%{NUMBER:bytes}" }
        }
        grok {
          break_on_match => false
          match => { "resource" => "/%{DATA:dropFirstValue}/%{DATA:dropSecondValue}/%{DATA:repo}/%{GREEDYDATA:resource_path}" }
        }

        mutate {
          remove_field => ["dropFirstValue", "dropSecondValue"]
        }
      }
      elseif [@metadata][copyOfMessage][4] =~ /^\/list\// or [@metadata][copyOfMessage][4] =~ /^\/simple\// {
        grok {
          break_on_match => false
          match => { "message" => "%{DATA:timestamp_local}\|%{NUMBER:duration}\|%{WORD:requesttype}\|%{DATA:username}\|%{DATA:resource}\|%{NUMBER:statuscode}\|%{NUMBER:bytes}" }
        }
        grok {
          break_on_match => false
          match => { "resource" => "/%{DATA:dropFirstValue}/%{DATA:repo}/%{GREEDYDATA:resource_path}" }
        }

        mutate {
           remove_field => ["dropFirstValue"]
        }
      }
      else{
        grok {
            # Enable multiple matchers
          break_on_match => false

          match => { "message" => "%{DATA:timestamp_local}\|%{NUMBER:duration}\|%{WORD:requesttype}\|%{DATA:username}\|%{DATA:resource}\|%{NUMBER:statuscode}\|%{NUMBER:bytes}" }

            # Extract repo and path
          match => { "resource" => "/%{DATA:repo}/%{GREEDYDATA:resource_path}"}

        }
      }
      grok {
        break_on_match => false
        match => { "resource_path" => "(?<resource_name>[^/]+$)" }
      }
      grok {
        break_on_match => false
        match => { "resource_path" => "(?<resource_type>[^.]+$)" }
      }
}

```

**The sample requests for the filter are:**  
20190615|4|method|userend|/test/value/user-info/1.1|500|2  
20190615|4|method|userend|/simple/user/123/1.1|500|2  
20190615|4|method|userend|/list/resolve/123/1.1|500|2

**Use-Case:**

1. I want to drop the first couple of words from "/test/value/user-info/1.1" if it starts with /test/
2. I want to drop the first word from "/simple/user/123/1.1" if it starts with /simple/
3. I want to drop the first word from "/list/resolve/123/1.1" if it starts with /list/

Now the above code works fine for my use-cases but looks a little hard to maintain, given we might have to add more if-else conditions in the future. I want to find out if there's any simpler way of doing this?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 5, 2019, 10:12am UTC](https://discuss.elastic.co/t/how-to-simplify-logic-or-format-code-for-grok-filter/193696/2 "2019-08-05T10:12:45Z")

</div>

I'm not sure if this is what you want to achieve, but

`%{DATA:timestamp_local}\|%{NUMBER:duration}\|%{WORD:requesttype}\|%{DATA:username}\|(/test/.*?/|/simple/|/list/)?%{DATA:resource}\|%{NUMBER:statuscode}\|%{NUMBER:bytes}`

would give you the resources "user-info/1.1", "user/123/1.1" and "resolve/123/1.1"

---

<div class="post-metadata">

**Author:** ![naveenrt23](https://avatars.discourse-cdn.com/v4/letter/n/47e85d/32.png) [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\
**Post date:** [August 19, 2019, 2:38pm UTC](https://discuss.elastic.co/t/how-to-simplify-logic-or-format-code-for-grok-filter/193696/4 "2019-08-19T14:38:20Z")

</div>

> [@Jenni](#):
>
> I'm not sure if this is what you want to achieve, but
> 
> `%{DATA:timestamp_local}\|%{NUMBER:duration}\|%{WORD:requesttype}\|%{DATA:username}\|(/test/.*?/|/simple/|/list/)?%{DATA:resource}\|%{NUMBER:statuscode}\|%{NUMBER:bytes}`
> 
> would give you the resources "user-info/1.1", "user/123/1.1" and "resolve/123/1.1"

I apologize for the delay but i see grok parse failure when i try this

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2019, 2:38pm UTC](https://discuss.elastic.co/t/how-to-simplify-logic-or-format-code-for-grok-filter/193696/5 "2019-09-16T14:38:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.