# Ignore a string from logstash from grok pattern
**URL:** https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561
**Category:** Logstash
**Created:** [November 26, 2019, 6:30pm UTC](https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561 "2019-11-26T18:30:48Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)
#### Post date: [November 26, 2019, 6:30pm UTC](https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561/1 "2019-11-26T18:30:48Z")
hi
from a log file like this
> 2019-11-22 13:02:01 INFO sometext:999 [applicationId=xxxxx] [version=xxxx] [hostname=hostname.domain] [logmessage=all went well]
can we remove the "sometext" and just show value of 999 so far the pattern i can get is this
```
filter {
grok {
match => { "message" => "%{DATESTAMP} %{LOGLEVEL} .*sometext.\s*:%{BASE10NUM:line} \[applicationId=%{DATA:applicationId}\] \[version=%{DATA:version}\] \[hostname=%{DATA:hostname}\] \[logmessage=%{DATA:logmessage}\]" }
```
this works fine when message has "sometext" but can we use a regex to ignore any text that is there for example instead of "sometext" it is "thistext"
Thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 26, 2019, 6:37pm UTC](https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561/2 "2019-11-26T18:37:31Z")
> [@whoatemyjam](#):
>
> %{DATESTAMP} %{LOGLEVEL} ._sometext.\s_:%{BASE10NUM:line}
You could use
```
"^%{TIMESTAMP_ISO8601} %{LOGLEVEL} %{WORD}:%{BASE10NUM:line}"
```
or even
```
"^%{TIMESTAMP_ISO8601} %{LOGLEVEL} (?:[^:]+):%{BASE10NUM:line}"
```
---
### Author:  [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)
#### Post date: [November 26, 2019, 6:46pm UTC](https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561/3 "2019-11-26T18:46:32Z")
Hi Badger
Thanks for coming back this soon, while waiting i tried this pattern and this worked too
> %{DATESTAMP} %{LOGLEVEL} ._[a-zA-Z]+.\s_:%{BASE10NUM:line}
Also tried your suggested solution and worked perfectly
Many Thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 26, 2019, 6:52pm UTC](https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561/4 "2019-11-26T18:52:23Z")
DATESTAMP should not match "2019-11-22 13:02:01". TIMESTAMP\_ISO8601 should.
---
### Author:  [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)
#### Post date: [November 26, 2019, 6:55pm UTC](https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561/5 "2019-11-26T18:55:22Z")
Many Thanks again , i will correct it now
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2019, 6:55pm UTC](https://discuss.elastic.co/t/ignore-a-string-from-logstash-from-grok-pattern/209561/6 "2019-12-24T18:55:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.