```
I am using the below grok pattern to split data;
```
grok {
match => { "message" => "<%{GREEDYDATA:timestamp}> <%{GREEDYDATA:data1}> <%{GREEDYDATA:data2}> <%{GREEDYDATA:data3}>" }
}
```
is it possible to achieve the same using `split` filter?
Thank you.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 21, 2018, 1:38pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-split-filter-instead-of-grok-in-logstash-to-chop-message/136878/2 "2018-06-21T13:38:07Z")
The split filter splits a single message into multiple messages so it's not equivalent to what you get with a grok filter.
Don't use multiple GREEEDYDATA like that. It's very ineffecient and could easily match things incorrectly.
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [June 21, 2018, 1:43pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-split-filter-instead-of-grok-in-logstash-to-chop-message/136878/3 "2018-06-21T13:43:20Z")
@magnusbaeck why I am using GREEEDYDATA there is because;
1. `GREEDYDATA .*`. Greedydata matches everything. I want everything inside `<` and `>`, and I dont want to perform validation. I believe that `.*` takes less effort compared to others.
2. My entire message is inside `` so that I have a start point `<` and end point `>` for messages.
Is this okay / still inefficient?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 21, 2018, 1:46pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-split-filter-instead-of-grok-in-logstash-to-chop-message/136878/4 "2018-06-21T13:46:55Z")
As you have well defined field separators, the [dissect filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) might be a good and efficient option here.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 21, 2018, 1:48pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-split-filter-instead-of-grok-in-logstash-to-chop-message/136878/5 "2018-06-21T13:48:26Z")
It's still inefficient since it's greedy and will first attempt to stuff ` ` into the `data1` field, but then it discovers that there's no text left for the two GREEDYDATA pattern to match against, so it backtracks and tries to match ` ` but then there's still one GREEDYDATA that doesn't get anything so... you get the idea.
Using DATA should be much more efficient, but I'd still expect it to be outperformed by `(?[^>]+)`.
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [June 22, 2018, 4:36am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-split-filter-instead-of-grok-in-logstash-to-chop-message/136878/6 "2018-06-22T04:36:57Z")
Oh 😮 ok ok.. now i understand..
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2018, 4:36am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-split-filter-instead-of-grok-in-logstash-to-chop-message/136878/7 "2018-07-20T04:36:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.