# Logstash Grok filters, split and path
**URL:** https://discuss.elastic.co/t/logstash-grok-filters-split-and-path/256015
**Category:** Logstash
**Created:** [November 19, 2020, 4:06pm UTC](https://discuss.elastic.co/t/logstash-grok-filters-split-and-path/256015 "2020-11-19T16:06:57Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Priyanka3](https://discuss.elastic.co/u/Priyanka3)
#### Post date: [November 19, 2020, 4:06pm UTC](https://discuss.elastic.co/t/logstash-grok-filters-split-and-path/256015/1 "2020-11-19T16:06:58Z")
Hi,
I am new to Elastic search. So, can anyone explain me the difference between Split, xpath and Grok filters? and under what situation do we use these?
Thanks,
Priyanka
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [November 20, 2020, 5:46am UTC](https://discuss.elastic.co/t/logstash-grok-filters-split-and-path/256015/2 "2020-11-20T05:46:58Z")
Hi,
I did not find an XPath filter in LogStash - did you mean the [xml filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html)?
The filters you named are completely different concepts:
[XML](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html)-Filter (and the other filters [CSV](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html) and [JSON](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) are made to parse their corresponding formats. If you have one of those formats parsing the document is really easy and no manual step like grok is necessary. Use them whenever possible.
The [grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) filter can parse unstructured data like log messages by using grok and regular expressions. It is very powerful but can be a bottle neck because of the regular expressions. It is used for unstructured text like logfiles.
I want to add the [dissect](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) filter here. It is similar to the grok pattern as it uses a pattern of the message to parse it. The difference between grok and dissect is that dissect does not support regular expressions so it does not support parsing lines that can have different content. This filter should be prefered over grok as its lack of regular expressions makes it faster than grok.
The odd filter here is the [split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html)-filter: It does not parse a String into a structured document but it splits a field or an array into separate documents. Have a look at the example from the documentation - if you have a document like this:
```json
{ "field1": "...",
"results": [
{ "result": "..." },
{ "result": "..." },
{ "result": "..." }
] }
```
If you use the split filter on this document you can get 3 separate documents looking like this:
```json
{ "field1": "...",
"results": {
"result": "..."
} }
```
Best regards
Wolfram
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 18, 2020, 5:47am UTC](https://discuss.elastic.co/t/logstash-grok-filters-split-and-path/256015/3 "2020-12-18T05:47:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.