# Ingest Pipelin Grok Regex

**URL:** <https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094>\
**Category:** Kibana\
**Created:** [June 26, 2024, 12:06pm UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094 "2024-06-26T12:06:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lehu](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lehu](https://discuss.elastic.co/u/lehu)\
**Post date:** [June 26, 2024, 12:06pm UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094/1 "2024-06-26T12:06:04Z")

</div>

So, I am trying to generate a Grok pattern that matches a part of a longer string. My string looks something like this: "Reason: SOME\_UPPERCASE\_INFO" and I only want to extract my SOME\_UPPERCASE\_INFO. Do you have any suggestion how I could solve this problem?

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [June 26, 2024, 12:19pm UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094/2 "2024-06-26T12:19:38Z")

</div>

> [@lehu](#):
>
> So, I am trying to generate a Grok pattern that matches a part of a longer string. My string looks something like this: "Reason: SOME\_UPPERCASE\_INFO" and I only want to extract my SOME\_UPPERCASE\_INFO. Do you have any suggestion how I could solve this problem?

Hi,

you can use the following Grok pattern:

```auto
Reason: %{WORD:info}

```

Regards

---

<div class="post-metadata">

**Author:** ![lehu](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lehu](https://discuss.elastic.co/u/lehu)\
**Post date:** [June 26, 2024, 12:20pm UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094/3 "2024-06-26T12:20:49Z")

</div>

> [@yago82](#):
>
> `Reason: %{WORD:info}`

Thank you so much but my problem is my other logs also have "reasons" and I really only want those who are upper case.

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [June 26, 2024, 2:24pm UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094/4 "2024-06-26T14:24:03Z")

</div>

Hi Lehu,

Where exactly you are trying to setup this grok pattern? on logstash or Grok processor on Elasticsearch?

---

<div class="post-metadata">

**Author:** ![lehu](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lehu](https://discuss.elastic.co/u/lehu)\
**Post date:** [June 27, 2024, 6:44am UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094/5 "2024-06-27T06:44:47Z")

</div>

On Elasticsearch

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [June 27, 2024, 1:01pm UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094/6 "2024-06-27T13:01:33Z")

</div>

You can use grok processor on Ingest pipeline -

Here is the complete example:

```auto
PUT _ingest/pipeline/extract_uppercase_and_spaces
{
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["Reason: %{GREEDYDATA:full_message}"]
      }
    },
    {
      "script": {
        "lang": "painless",
        "source": """
          String fullMessage = ctx.full_message;
          StringBuilder uppercaseAndSpaces = new StringBuilder();
          for (int i = 0; i < fullMessage.length(); i++) {
            char c = fullMessage.charAt(i);
            if (Character.isUpperCase(c) || Character.isSpaceChar(c)) {
              uppercaseAndSpaces.append(c);
            }
          }
          ctx.uppercase_and_spaces = uppercaseAndSpaces.toString();
        """
      }
    }
  ]
}

POST my_index/_doc?pipeline=extract_uppercase_and_spaces
{
  "message": "API is down. Here is the Reason: API key IS INVALID"
}

GET my_index/_search

```

Response

```auto
{
  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 1,
      "relation": "eq"
    },
    "max_score": 1,
    "hits": [
      {
        "_index": "my_index",
        "_id": "U2DIWZABe46rvky5I6nu",
        "_score": 1,
        "_source": {
          "message": "API is down. Here is the Reason: API key IS INVALID",
          "full_message": "API key IS INVALID",
          "uppercase_and_spaces": "API IS INVALID"
        }
      }
    ]
  }
}

```