# Logstash - extraction substring from the raw message
**URL:** https://discuss.elastic.co/t/logstash-extraction-substring-from-the-raw-message/130162
**Category:** Logstash
**Created:** [May 1, 2018, 8:52pm UTC](https://discuss.elastic.co/t/logstash-extraction-substring-from-the-raw-message/130162 "2018-05-01T20:52:20Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jfnoteba](https://discuss.elastic.co/u/jfnoteba)
#### Post date: [May 1, 2018, 8:52pm UTC](https://discuss.elastic.co/t/logstash-extraction-substring-from-the-raw-message/130162/1 "2018-05-01T20:52:20Z")
Hi Everyone,
I'm trying to see if there is any logstash plugin which we can use to perform a quick filtering on 2 substrings without need to parse the entire message using grok command:
An example of the log is below and I'm only interesting to extract the 2 substrings in Bold.
\<12\> May 1 11:46:42 EMCstorevntd: [fmt=evt] [evtid=1072] [date=2018-05-01T15:43:35Z] **[symid=000196801796]** [Device=00037] **[sev=warning]** = SRDF R2 device not ready."
With Logstatch, can I do similar regular expression like (symid=)[0-9]{12} to extract the symmetrix ID number and (sev=)(warning|critical) to extract the severity ?
thanks by advanced to share feedback
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [May 1, 2018, 9:37pm UTC](https://discuss.elastic.co/t/logstash-extraction-substring-from-the-raw-message/130162/2 "2018-05-01T21:37:11Z")
grok doesn't _need_ to match against the whole pattern; it can be used to extract specific bits, and the [`break_on_match => false`](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-break_on_match) directive allows us to extract multiple bits independent of their order:
```auto
filter {
grok {
break_on_match => false
match => {
"message" => ["\[symid=%{NUMBER:symid}\]", "\[sev=%{LOGLEVEL:sev}\]"]
}
}
}
```
When using [`break_on_match => false`](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-break_on_match), you'll want to make sure your the patterns begin with as specific a string as possible, which will empower the matcher to avoid unnecessary work.
---
### Author:  [@jfnoteba](https://discuss.elastic.co/u/jfnoteba)
#### Post date: [May 2, 2018, 12:07pm UTC](https://discuss.elastic.co/t/logstash-extraction-substring-from-the-raw-message/130162/3 "2018-05-02T12:07:04Z")
Thanks you very much. It works perfectly.
Can I put in the same grok filter break\_on\_match =\>fais and break\_on\_match =true to concatenate multiple filter matching ?
Something like that :
filter {
grok {
break\_on\_match =\> true
match =\> {
"message" =\> [xxxxx]
break\_on\_match =\> false
match =\> {
"message" =\> [xxxxx]
}
}
Thanks again to share your knowledge.
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [May 2, 2018, 4:59pm UTC](https://discuss.elastic.co/t/logstash-extraction-substring-from-the-raw-message/130162/4 "2018-05-02T16:59:21Z")
no; the `break_on_match` directive applies to the entire grok filter instance and cannot be flip/flopped.
You can, however, use multiple grok filters:
```auto
filter {
# without the `break_on_match` directive (or when explicitly set to `true`),
# once a match is found, the remaining patterns are not run
grok {
match => {
"message" => [xxxxx, yyyy]
}
}
# when `break_on_match` is set to `false`, grok will attempt to capture using
# all patterns, even after it finds a match.
grok {
break_on_match => false
match => {
"message" => [zzzzz, wwww]
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2018, 4:59pm UTC](https://discuss.elastic.co/t/logstash-extraction-substring-from-the-raw-message/130162/5 "2018-05-30T16:59:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.