# Logstash filter customize
**URL:** https://discuss.elastic.co/t/logstash-filter-customize/96903
**Category:** Logstash
**Created:** [August 14, 2017, 5:10am UTC](https://discuss.elastic.co/t/logstash-filter-customize/96903 "2017-08-14T05:10:37Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [August 14, 2017, 5:10am UTC](https://discuss.elastic.co/t/logstash-filter-customize/96903/1 "2017-08-14T05:10:37Z")
my data type:
[INFO] status =\> FAIL | client : [MTB] | cell : [1746710009] | message\_delivery\_time : [2017-08-07 09:46:27,807] | operator: [GP]
[INFO] status =\> SENT | client : [IPDC] | cell : [1746710009] | message\_delivery\_time : [2017-08-07 09:46:27,807] | operator: [ROBI]
I need discovery available field
Host:
status:
client:
operator:
message\_delivery\_time:
how can I write logstash filter?
Please anybody help me
thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 14, 2017, 5:28am UTC](https://discuss.elastic.co/t/logstash-filter-customize/96903/2 "2017-08-14T05:28:44Z")
You have two options:
- Use a grok filter to extract all the fields you're interested in. If you don't know regular expressions you can get help from the grok constructor web site.
- Use a grok filter to separate "[INFO] status =\> fail" from the rest of the string, which is instead passed to a kv filter.
The latter is more flexible and tolerant against changes in the log message.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 11, 2017, 5:28am UTC](https://discuss.elastic.co/t/logstash-filter-customize/96903/3 "2017-09-11T05:28:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.