# Logstash : Filter column values in a log **URL:** \ **Category:** Logstash\ **Created:** [December 21, 2018, 2:45pm UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862 "2018-12-21T14:45:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Moulika\_Magatapalli1](https://avatars.discourse-cdn.com/v4/letter/m/9f8e36/32.png) [@Moulika\_Magatapalli1](https://discuss.elastic.co/u/Moulika_Magatapalli1)\ **Post date:** [December 21, 2018, 2:45pm UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862/1 "2018-12-21T14:45:49Z")
Hi , I am using Logstash to parse and filter the data. The input data looks something like this: ``` Nov 28 23:00:31 Phase 0 ended (4 seconds) X Time X/S X/SK S/C 0.140 [: 1] 0% TEXT 0.270 [: 1] 0% TEXT 0.080 [: 1] 0% TEXT -------------------------------------------------------------------------------- B/W R/W S/R SF V P/W 0 0 [: : 0] 7535996 text text 0 3 [: : 0] 7535996 text text 1235 2 [: : 0] 7535996 text text out 0 [: : 0] 7535996 text text 0 0 [: : 0] 7535996 text text ----------------------------------------------------------------------------------- ``` I want to access R/W column values. Can anyone help me solving the problem ? ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [December 24, 2018, 5:56am UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862/2 "2018-12-24T05:56:58Z")
What is the data that you need from this? And how are you consuming this? ---
**Author:** ![Moulika\_Magatapalli1](https://avatars.discourse-cdn.com/v4/letter/m/9f8e36/32.png) [@Moulika\_Magatapalli1](https://discuss.elastic.co/u/Moulika_Magatapalli1)\ **Post date:** [December 24, 2018, 6:11am UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862/3 "2018-12-24T06:11:22Z")
In the above sample log, there is a column R/W. I want the sum of R/w column. ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [December 24, 2018, 10:23am UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862/4 "2018-12-24T10:23:49Z")
And how is this data coming? Is it possible to filter out the remaining data from the file? If you can filter it out, you can use dissect or kv to easily parse the data. Regards, Nachiket ---
**Author:** ![Moulika\_Magatapalli1](https://avatars.discourse-cdn.com/v4/letter/m/9f8e36/32.png) [@Moulika\_Magatapalli1](https://discuss.elastic.co/u/Moulika_Magatapalli1)\ **Post date:** [December 26, 2018, 6:30am UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862/5 "2018-12-26T06:30:15Z")
Thank you for the response. It was quite helpful but it couldn't solve my problem. In my case it is unable to detect the pattern. This is how my dissect is : `dissect { mapping => { "message" => "%{B/W} %{R/W} %{S/R} %{SF} %{V} %{P/W}" } }` ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [December 27, 2018, 7:35am UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862/6 "2018-12-27T07:35:34Z")
How did you filter out the data that was not needed? Please post the solution if you don't mind, it will probably help others in the future. From the sample logs, it looks like there are multiple delimiters in your input data. The dissect pattern does not account for multiple consecutive delimiters. Try using the following kind of pattern. More information is available in the [docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html#_delimiters_used_as_padding_to_visually_align_fields). ```auto %{BW->} %{RW->} %{SR->} %{SF->} %{V->} %{P/W} ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 24, 2019, 7:35am UTC](https://discuss.elastic.co/t/logstash-filter-column-values-in-a-log/161862/7 "2019-01-24T07:35:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.