# Is it possible to Grok out part of a string and then the whole string?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-grok-out-part-of-a-string-and-then-the-whole-string/102725>\
**Category:** Logstash\
**Created:** [October 4, 2017, 3:29pm UTC](https://discuss.elastic.co/t/is-it-possible-to-grok-out-part-of-a-string-and-then-the-whole-string/102725 "2017-10-04T15:29:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cchooks2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cchooks2/32/21987_2.png) [@cchooks2](https://discuss.elastic.co/u/cchooks2)\
**Post date:** [October 4, 2017, 3:29pm UTC](https://discuss.elastic.co/t/is-it-possible-to-grok-out-part-of-a-string-and-then-the-whole-string/102725/1 "2017-10-04T15:29:04Z")

</div>

Hello,

I have the following request type:

"GET /rest/api/latest/search?jql=project+%3D+%22THP%22+AND+type+%3D+%22Defect%22+order+by+updated+desc&startAt=0&fields=summary,updated HTTP/1.1"

Is it possible to GROK out "GET" and place it in http\_status and then GROK out "GET /rest/api/latest/search?jql=project+%3D+%22THP%22+AND+type+%3D+%22Defect%22+order+by+updated+desc&startAt=0&fields=summary,updated HTTP/1.1" and place that in a field called request\_type?

Thanks.

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [October 5, 2017, 5:18am UTC](https://discuss.elastic.co/t/is-it-possible-to-grok-out-part-of-a-string-and-then-the-whole-string/102725/2 "2017-10-05T05:18:00Z")

</div>

> [@cchooks2](#):
>
> "GET /rest/api/latest/search?jql=project+%3D+%22THP%22+AND+type+%3D+%22Defect%22+order+by+updated+desc&startAt=0&fields=summary,updated HTTP/1.1"

you can simple nest named pattern groups like

```
"(?<request_type>(?<http_status>[A-Z]+)%{GREEDYDATA})"

```

---

<div class="post-metadata">

**Author:** ![cchooks2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cchooks2/32/21987_2.png) [@cchooks2](https://discuss.elastic.co/u/cchooks2)\
**Post date:** [October 5, 2017, 6:41pm UTC](https://discuss.elastic.co/t/is-it-possible-to-grok-out-part-of-a-string-and-then-the-whole-string/102725/3 "2017-10-05T18:41:29Z")

</div>

@Shaoranlaos,

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2017, 6:41pm UTC](https://discuss.elastic.co/t/is-it-possible-to-grok-out-part-of-a-string-and-then-the-whole-string/102725/4 "2017-11-02T18:41:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.