# Is there any way to get the next word when word is matched

**URL:** <https://discuss.elastic.co/t/is-there-any-way-to-get-the-next-word-when-word-is-matched/159243>\
**Category:** Elasticsearch\
**Created:** [December 3, 2018, 8:58pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-the-next-word-when-word-is-matched/159243 "2018-12-03T20:58:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sudhakar\_katakara](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@sudhakar\_katakara](https://discuss.elastic.co/u/sudhakar_katakara)\
**Post date:** [December 3, 2018, 8:58pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-the-next-word-when-word-is-matched/159243/1 "2018-12-03T20:58:09Z")

</div>

we have csv file which contains data(basically events data from different sources) and it has one field named Body. we have uploaded those file data into elasticsearch index. the Body field has multiple lines and it has "host" word then followed by "host name". each document has host word but hostname is different. I can run queries in Kibana to find out the Body has "host" . But I need to run query to store the hostname value into one field and need to apply aggregation(group by) on hostname. can you please let me know is it possible to create query to search for "host" word in body field then store next word of host ie hostname to different field then apply group by on that new stored field ?

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [December 5, 2018, 10:24pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-the-next-word-when-word-is-matched/159243/2 "2018-12-05T22:24:22Z")

</div>

Sounds like you still need to do more parsing, prior to indexing, to parse the `Body` field and extract the value for both `host` and `hostname`. There are two ways here:

1. If you can just ingest the data again, then either use [Logstash with grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) or [Ingest Pipeline also with grok](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html) to parse this `Body`.
2. If you can't ingest anymore, then reindex into a new index using the [Reindex API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) and a script to parse this `Body`.

After this reprocessing you may be able to do more detailes queries over your data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2019, 10:27pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-the-next-word-when-word-is-matched/159243/3 "2019-01-02T22:27:28Z")

</div>

Closed on January 2, 2019, 10:27pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.