# Logstash+ES message parsing to JSON **URL:** \ **Category:** Elasticsearch\ **Created:** [February 14, 2014, 9:56pm UTC](https://discuss.elastic.co/t/logstash-es-message-parsing-to-json/15819 "2014-02-14T21:56:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![san](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@san](https://discuss.elastic.co/u/san)\ **Post date:** [February 14, 2014, 9:56pm UTC](https://discuss.elastic.co/t/logstash-es-message-parsing-to-json/15819/1 "2014-02-14T21:56:30Z")
I have the following message to parse: \<6\> Jan 9 07:19:26 w2k8r233110 0|TestCompany|Analytics|8.0.1310|TestSignature|This is test message|Medium|src=10.100.1.100 Here the actual message part is: 0|TestCompany|Analytics|8.0.1310|TestSignature|This is test message|Medium|src=10.100.1.100 Could someone help me out in creating a JSON from this message? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7d0cc81a-f02f-4b4f-b43b-53534a31ea84%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7d0cc81a-f02f-4b4f-b43b-53534a31ea84%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Fernando\_Emwferm](https://avatars.discourse-cdn.com/v4/letter/f/898d66/32.png) [@Fernando\_Emwferm](https://discuss.elastic.co/u/Fernando_Emwferm)\ **Post date:** [February 17, 2014, 3:25pm UTC](https://discuss.elastic.co/t/logstash-es-message-parsing-to-json/15819/2 "2014-02-17T15:25:12Z")
Hej San: Not sure exactly if this is what you need/want kind of new to this myself. But if you need a parsing string for this type of message so logstash can identify some specific parts from it. There is a very good site called [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) where you can put the line to parse and then test the pattern line to test so you can see if the parsing is working. It has helped me quite a lot. For your specific part of the message you could try this line: (?[^|]+)|(?[^|]+)|(?[^|]+)|(?[^|]+)|(?[^|]+)|(?[^|]+)|(?[^|]+)|(?.\*) This will put the "0" in field1, "TestCompany" in field2 etc...And pass these as fields in elasticsearch. Hope this helps, s.r./F On Friday, February 14, 2014 10:56:30 PM UTC+1, san wrote: > I have the following message to parse: > > \<6\> Jan 9 07:19:26 w2k8r233110 > 0|TestCompany|Analytics|8.0.1310|TestSignature|This is test > message|Medium|src=10.100.1.100 > > Here the actual message part is: > 0|TestCompany|Analytics|8.0.1310|TestSignature|This is test > message|Medium|src=10.100.1.100 > > Could someone help me out in creating a JSON from this message? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/11db47b2-1ae7-468a-8f53-8d9fee10da43%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/11db47b2-1ae7-468a-8f53-8d9fee10da43%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:49am UTC](https://discuss.elastic.co/t/logstash-es-message-parsing-to-json/15819/3 "2017-07-06T01:49:37Z")