# Matching direction in dissect

**URL:** <https://discuss.elastic.co/t/matching-direction-in-dissect/195995>\
**Category:** Logstash\
**Created:** [August 20, 2019, 8:04pm UTC](https://discuss.elastic.co/t/matching-direction-in-dissect/195995 "2019-08-20T20:04:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\
**Post date:** [August 20, 2019, 8:04pm UTC](https://discuss.elastic.co/t/matching-direction-in-dissect/195995/1 "2019-08-20T20:04:40Z")

</div>

I have log lines like the following:

src=192.168.100.1:502 rest of message  
src=[::1]:304 message details

The format is `<ip address>:<port>`. I could use dissect easily except for the case shown in the second line. This could be solved if I could specify the direction of matching in dissect.

I could extract the entire string after `src=` till the next space into a field and then split by `:` from the right instead of doing it from the left. Is such a thing possible in Logstash currently?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 20, 2019, 8:22pm UTC](https://discuss.elastic.co/t/matching-direction-in-dissect/195995/2 "2019-08-20T20:22:45Z")

</div>

Right, use dissect to grab everything between the = and the space, then grok it

```
    dissect { mapping => { "message" => "src=%{ipAndPort} %{restOfLine}" } }
    grok { match => { "ipAndPort" => "%{DATA:ip}:%{NUMBER:port}$" } }
```

---

<div class="post-metadata">

**Author:** ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\
**Post date:** [August 21, 2019, 3:55am UTC](https://discuss.elastic.co/t/matching-direction-in-dissect/195995/3 "2019-08-21T03:55:40Z")

</div>

Thanks for the clarification @Badger. Would it help to have a direction specification in dissect? I think it can serve as a minor optimization.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 21, 2019, 12:29pm UTC](https://discuss.elastic.co/t/matching-direction-in-dissect/195995/4 "2019-08-21T12:29:01Z")

</div>

Not sure. The reason dissect is so fast is that has very limited functionality. Complicating the parsing might not be worth it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2019, 12:29pm UTC](https://discuss.elastic.co/t/matching-direction-in-dissect/195995/5 "2019-09-18T12:29:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.