# Match and extract last part of log in pipe delimited log
**URL:** https://discuss.elastic.co/t/match-and-extract-last-part-of-log-in-pipe-delimited-log/90086
**Category:** Logstash
**Created:** [June 20, 2017, 11:13am UTC](https://discuss.elastic.co/t/match-and-extract-last-part-of-log-in-pipe-delimited-log/90086 "2017-06-20T11:13:25Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Pranav1](https://discuss.elastic.co/u/Pranav1)
#### Post date: [June 20, 2017, 11:13am UTC](https://discuss.elastic.co/t/match-and-extract-last-part-of-log-in-pipe-delimited-log/90086/1 "2017-06-20T11:13:25Z")
Logstash is receving following log -
**\> Timestamp|Field1|Field2|...|Field n|Log message**
The number of fields is varaible and not fixed.
My goal is to extract just the Timestamp and Log message and add it as a new key value pair in the document as shown below-
> {
> "Timestamp": "2017-06-15T09:39:02.619Z",
> "message": "Log message"
> }
I tried using grok filter. I can get the timestamp using its 'match' option.
> grok {
> match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:Timestamp}" }
> }
**But I am unable to match the log message as the fields in between are variable.**
Is it possible to do this using grok filter or can any other filter help?
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [June 20, 2017, 11:42am UTC](https://discuss.elastic.co/t/match-and-extract-last-part-of-log-in-pipe-delimited-log/90086/2 "2017-06-20T11:42:16Z")
Grok should be fine.
After the `%{TIMESTAMP_ISO8601:Timestamp}\|` allow for the first pipe, then allow for a variable number of `([^|]+\|)+` then the message `%{GREEDYDATA:message}`
See [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match)
I used this Grok pattern
```auto
%{TIMESTAMP_ISO8601:Timestamp}\|(?:[^|]+\|)+%{GREEDYDATA:msg}
```
I used these lines
```auto
2017-06-15T09:39:02.619Z|A|B|C|D|E|this is a long message
2017-06-15T09:39:04.619Z|A|B|E|this is a second long message
```
I got this result
```auto
2017-06-15T09:39:02.619Z|A|B|C|D|E|this is a long message
MATCHED
Timestamp 2017-06-15T09:39:02.619Z
msg this·is·a·long·message
2017-06-15T09:39:04.619Z|A|B|E|this is a second long message
MATCHED
Timestamp 2017-06-15T09:39:04.619Z
msg this·is·a·second·long·message
```
---
### Author:  [@Pranav1](https://discuss.elastic.co/u/Pranav1)
#### Post date: [June 21, 2017, 2:54pm UTC](https://discuss.elastic.co/t/match-and-extract-last-part-of-log-in-pipe-delimited-log/90086/3 "2017-06-21T14:54:19Z")
Thanks a lot Guy. It helped me.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2017, 2:54pm UTC](https://discuss.elastic.co/t/match-and-extract-last-part-of-log-in-pipe-delimited-log/90086/4 "2017-07-19T14:54:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.