# Logstash (elastic stack 5.6) grok regex

**URL:** <https://discuss.elastic.co/t/logstash-elastic-stack-5-6-grok-regex/109553>\
**Category:** Logstash\
**Created:** [November 29, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-elastic-stack-5-6-grok-regex/109553 "2017-11-29T09:36:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [November 29, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-elastic-stack-5-6-grok-regex/109553/1 "2017-11-29T09:36:13Z")

</div>

Hi everyone!  
There is a problem I struggle with for a while:  
I have data in a json format:

```
"documentsList": [{
		"commandScn": "108058599",
		"commandCommitScn": "108058600",
		"commandSequence": "0",
		"commandType": "UPDATE",
		"commandTimestamp": "2017-08-22 14:37:53+03:000",
		"objectDBName": "DEV2",
		"objectSchemaName": "YISHAIN",
		"objectId": "CUSTOMERS",
		"changedFieldsList": [{
				"fieldId": "CUSTOMER_ID",
				"fieldType": "NUMBER",
				"fieldValue": "17",
				"fieldChanged": "N"
			}, {
				"fieldId": "CUSTOMER_FIRST_NAME",
				"fieldType": "VARCHAR2",
				"fieldValue": "Daniel",
				"fieldChanged": "N"
			}, {
				"fieldId": "CUSTOMER_LAST_NAME",
				"fieldType": "VARCHAR2",
				"fieldValue": "Washington",
				"fieldChanged": "N"
			}, {
				"fieldId": "CUSTOMER_COUNTRY",
				"fieldType": "VARCHAR2",
				"fieldValue": "France",
				"fieldChanged": "N"
			}, {
				"fieldId": "CUSTOMER_CITY",
				"fieldType": "VARCHAR2",
				"fieldValue": "La Roche-sur-Yon",
				"fieldChanged": "N"
			}
		}]
}]

```

What I want is to fetch the values of the fields: fieldId, fieldType, fieldValue, fieldChanged etc. I want to aggregate by these terms afterwards in kibana 5.6.

My questions are:

1. How can I tell grok to fetch everything after a word (because I want the values of the keys, not the leys themselves)? does elasticsearch support lookbehind? if so - can anyone give me an example of how to accomplish this?
2. If elastic's regex doesn't support it, how can I get this done?

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 29, 2017, 9:45am UTC](https://discuss.elastic.co/t/logstash-elastic-stack-5-6-grok-regex/109553/2 "2017-11-29T09:45:10Z")

</div>

I don't understand. The grok filter is used to parse a text using regular expressions and extract fields from the text. What you have isn't a text but an hierarchical data structure. You can certainly apply a grok filter on individual fields in this structure but that doesn't sound like what you're asking for.

---

<div class="post-metadata">

**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Post date:** [November 29, 2017, 9:58am UTC](https://discuss.elastic.co/t/logstash-elastic-stack-5-6-grok-regex/109553/3 "2017-11-29T09:58:22Z")

</div>

Hi, I'm new to the elastic stack, so I don't know the ropes yet.  
How can I achive my goal using other filters? I tries useing mutate and json filters, to no avail.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 29, 2017, 10:24am UTC](https://discuss.elastic.co/t/logstash-elastic-stack-5-6-grok-regex/109553/4 "2017-11-29T10:24:23Z")

</div>

You can send what you have to Elasticsearch, but it's not clear if what you've shown is the best representation of the data. Perhaps you want one document per item in the changedFieldsList array? It depends on what you want to do with the data.

Sorting out how to store your data is probably better to ask in the Elasticsearch group.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2017, 10:24am UTC](https://discuss.elastic.co/t/logstash-elastic-stack-5-6-grok-regex/109553/5 "2017-12-27T10:24:44Z")

</div>

Closed on December 27, 2017, 10:24am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.