# Logstash Filter to parse a string
**URL:** https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780
**Category:** Logstash
**Created:** [July 29, 2019, 9:33pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780 "2019-07-29T21:33:53Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Gabriel\_Shen](https://discuss.elastic.co/u/Gabriel_Shen)
#### Post date: [July 29, 2019, 9:33pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780/1 "2019-07-29T21:33:54Z")
I have a log file with each line being a long string (each being very similar). An example line is = "12345555678890,1234567890ABBCCDDEEFFGG123456789GGFFFEEDDCCBBAA" All I want is the numbers in between the two G's. Those numbers are always at the same index, can I get that part of the string by index somehow?
Sorry if this is a very easy question, I just started using logstash and really unfamiliar with it.
PS, if you know how to manipulate the taken string and rearrange the characters as well, much would be appreciated! Thank you!!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 29, 2019, 10:26pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780/2 "2019-07-29T22:26:25Z")
Try
```
grok { match => { "message" => "GG%{NUMBER:someField:int}GG" } }
```
---
### Author:  [@Gabriel\_Shen](https://discuss.elastic.co/u/Gabriel_Shen)
#### Post date: [July 30, 2019, 3:40pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780/3 "2019-07-30T15:40:40Z")
Thanks this helped! But for some reason the int field in the middle starts with a 0 so it wasn't captured in the "somefield"
Also, if the field was FFFFFFFFFFFF07123456678997F8FFF, how can i get the num with 8 included that's between the two F's. I would like to have it as the same field as the first part.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 30, 2019, 3:51pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780/4 "2019-07-30T15:51:00Z")
To capture the leading zero you could change it to
```
grok { match => { "message" => "GG(?[0-9]+)GG" } }
```
For the other string what substring do you want to extract?
---
### Author:  [@Gabriel\_Shen](https://discuss.elastic.co/u/Gabriel_Shen)
#### Post date: [July 30, 2019, 4:03pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780/5 "2019-07-30T16:03:05Z")
I want to be able to extract the "07123456678997F8" without the F in "1234564675FFFFFFFFFFFF07123456678997F8FFF"
But thank you so much for the help! 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2019, 4:03pm UTC](https://discuss.elastic.co/t/logstash-filter-to-parse-a-string/192780/6 "2019-08-27T16:03:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.