# Match part of a log

**URL:** <https://discuss.elastic.co/t/match-part-of-a-log/42117>\
**Category:** Logstash\
**Created:** [February 18, 2016, 9:46am UTC](https://discuss.elastic.co/t/match-part-of-a-log/42117 "2016-02-18T09:46:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mr\_rob](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@mr\_rob](https://discuss.elastic.co/u/mr_rob)\
**Post date:** [February 18, 2016, 9:46am UTC](https://discuss.elastic.co/t/match-part-of-a-log/42117/1 "2016-02-18T09:46:50Z")

</div>

I've seen how to match certain logs, and match every line. But i want to do something a little different (if possible??)

I want to parse a log (that has many different line formats, looking for a particular keyword and then forward the variable pairs from this line to elastic, dropping all the other lines.

the line (and only line) will contain  
Feb 18 11:51:36 07[IKE] \<ikev1 22400\> assigning virtual IP xx.xx.xx.xx to peer 'yyyyyyyy'  
i want this, i want parts date, ip and peer

not all lines in the log (charon) will be like this

is this possible?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 18, 2016, 9:49am UTC](https://discuss.elastic.co/t/match-part-of-a-log/42117/2 "2016-02-18T09:49:28Z")

</div>

Use [conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) to select for which messages the [drop filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html) should be used. To extract certain parts of the message to separate fields use the [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) as usual.

---

<div class="post-metadata">

**Author:** ![mr\_rob](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@mr\_rob](https://discuss.elastic.co/u/mr_rob)\
**Post date:** [February 18, 2016, 10:22am UTC](https://discuss.elastic.co/t/match-part-of-a-log/42117/3 "2016-02-18T10:22:40Z")

</div>

thanks,  
as i see it the only way is to create match patterns for the drop?  
and then grok the one i want?

was hoping i could work a way of grok one thing i want, and drop anything else..

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 18, 2016, 10:36am UTC](https://discuss.elastic.co/t/match-part-of-a-log/42117/4 "2016-02-18T10:36:42Z")

</div>

Well, you could do

```nohighlight
grok {
  match => ...
}
if "_grokparsefailure" in [tags] {
  drop { }
}

```

to drop all events that don't match the grok expression.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/match-part-of-a-log/42117/5 "2017-07-06T05:10:53Z")

</div>