# I want to further split messages into json and message after splitting them with grok

**URL:** <https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243>\
**Category:** Logstash\
**Created:** [May 6, 2021, 6:22am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243 "2021-05-06T06:22:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![its-ogawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/its-ogawa/32/120829_2.png) [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Post date:** [May 6, 2021, 6:22am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243/1 "2021-05-06T06:22:28Z")

</div>

I want to further split messages into json and message after splitting them with grok.

I am using grok to split messages.  
I'm getting a log in json format in a field, and I found a case where the field contains both json and message.  
How can I get only the json part for the case that contains both json and message?

target log:  
`... snip ... {"mode":0, ... snip ... } Log does not exist. ... snip ...`

my grok:

```auto
grok{
	"match" => { "message" => " ... snip ... %{GREEDYDATA:MY_JSON} ... snip ..." }
}

```

result:  
`MY_JSON : {"mode":0, ... snip ... } Log does not exist.`

expect:  
`MY_JSON : {"mode":0, ... snip ... }`

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [May 6, 2021, 6:32am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243/2 "2021-05-06T06:32:02Z")

</div>

Hi,

You can also use regular expressions within grok so for your example you could use the following grok pattern: `... snip ... (?<MY_JSON>\{.*\}) %{GREEDYDATA:message} ... snip ...`

This produces the following result:

```auto
{
  "message": "Log does not exist.",
  "MY_JSON": "{\"mode\":0, ... snip ... }"
}

```

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![its-ogawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/its-ogawa/32/120829_2.png) [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Post date:** [May 6, 2021, 7:13am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243/3 "2021-05-06T07:13:51Z")

</div>

Thank you for your prompt reply.  
Your advice is spot on.

Please tell me one more thing.  
In the previous messages, the message is included after the json, but in some cases, the message is not included.  
How can I deal with the case where the message is not included?

target:

case1:  
`... snip ... {"mode":0, ... snip ... } Log does not exist. ... snip ...`

case2:  
`... snip ... {"mode":0, ... snip ... } ... snip ...`

expect:

case1:

```auto
MY_JSON : {"mode":0, ... snip ... }
message : Log does not exist.

```

case2:

```auto
MY_JSON : {"mode":0, ... snip ... }

```

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [May 6, 2021, 7:17am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243/4 "2021-05-06T07:17:20Z")

</div>

This is not a big problem: `... snip ... (?<MY_JSON>\{.*\})( %{GREEDYDATA:message})? ... snip ...`

The `()?` makes the content optional so this will work for both cases.

---

<div class="post-metadata">

**Author:** ![its-ogawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/its-ogawa/32/120829_2.png) [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Post date:** [May 6, 2021, 7:23am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243/5 "2021-05-06T07:23:10Z")

</div>

Very nice!

`()? `is quite a help to me.  
Thanks to you, I won't have to write any extra `if{} else if ... {}`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2021, 7:24am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243/6 "2021-06-03T07:24:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.