# Logstash grok filter with regex

**URL:** <https://discuss.elastic.co/t/logstash-grok-filter-with-regex/157148>\
**Category:** Logstash\
**Created:** [November 17, 2018, 4:06am UTC](https://discuss.elastic.co/t/logstash-grok-filter-with-regex/157148 "2018-11-17T04:06:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![srkrishna](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@srkrishna](https://discuss.elastic.co/u/srkrishna)\
**Post date:** [November 17, 2018, 4:06am UTC](https://discuss.elastic.co/t/logstash-grok-filter-with-regex/157148/1 "2018-11-17T04:06:50Z")

</div>

Hello,

I was trying to create fields in logstash grok filter based on the source file name which contains a regex match for hostname.

I have the below log lines

########################################################  
/var/log/iptrace/log/IP2\_HOSTNAME1\_HDDFTSC\_00608300.C1001.log  
/var/log/iptrace/log/IP2\_HOSTNAME2\_00603200.C2001.log  
/var/log/iptrace/log/IP2\_HOSTNAME3\_HDDFTSC\_00608112.C1001.log  
/var/log/iptrace/log/IP2\_HOSTNAME4\_00603477.C5001.log  
###########################################################

Grok match regex : ._IP2\_(?._)_.\* or .\*_(?._)\_._

I get the output as

/var/log/iptrace/log/IP2\_HOSTNAME1\_HDDFTSC\_00608300.C1001.log  
**MATCHED**  
hostname HOSTNAME1\_HDDFTSC  
/var/log/iptrace/log/IP2\_HOSTNAME2\_00603200.C2001.log  
**MATCHED**  
hostname HOSTNAME2  
/var/log/iptrace/log/IP2\_HOSTNAME3\_HDDFTSC\_00608112.C1001.log  
**MATCHED**  
hostname HOSTNAME3\_HDDFTSC  
/var/log/iptrace/log/IP2\_HOSTNAME4\_00603477.C5001.log  
**MATCHED**  
hostname HOSTNAME4

I was trying to test all kinds of regex to strip/truncate the string after the"HOSTNAME\*".  
Can any one please help me fix this issue?

I need to apply this in logstash.

Appreciate your valuable response.

Regards,  
Siva

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2018, 4:06am UTC](https://discuss.elastic.co/t/logstash-grok-filter-with-regex/157148/2 "2018-12-15T04:06:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.