# Matching/Finding keywords in an already parsed field via GROK

**URL:** <https://discuss.elastic.co/t/matching-finding-keywords-in-an-already-parsed-field-via-grok/171999>\
**Category:** Logstash\
**Created:** [March 12, 2019, 4:11pm UTC](https://discuss.elastic.co/t/matching-finding-keywords-in-an-already-parsed-field-via-grok/171999 "2019-03-12T16:11:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Post date:** [March 12, 2019, 4:11pm UTC](https://discuss.elastic.co/t/matching-finding-keywords-in-an-already-parsed-field-via-grok/171999/1 "2019-03-12T16:11:35Z")

</div>

Hello,  
So i have an unstructured log, after applying a GROK filter, i was able to parse it into seperate fields.  
The problem is that the last field which is {GREEDYDATA:Message} contains some keywords like "userID", "Failure" , "Established",... i would like to detect them.  
Any suggestions ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 12, 2019, 5:45pm UTC](https://discuss.elastic.co/t/matching-finding-keywords-in-an-already-parsed-field-via-grok/171999/2 "2019-03-12T17:45:04Z")

</div>

One approach would be to use

```
    grok {
        break_on_match => false
        match => {
            "message" => [
             "(^|\W)(?<keyword>Established)(\W|$)",
             "(^|\W)(?<keyword>Failure)(\W|$)",
             "(^|\W)(?<keyword>userID)(\W|$)"
            ]
        }
    }

```

That will result in keyword being a string if there is one match, or an array if there is more than one. Unless the last pattern (userID) matches, there will be a \_grokparsefailure.

---

<div class="post-metadata">

**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Post date:** [March 15, 2019, 9:28am UTC](https://discuss.elastic.co/t/matching-finding-keywords-in-an-already-parsed-field-via-grok/171999/3 "2019-03-15T09:28:02Z")

</div>

@Badger thanks for the replay, yep it worked fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2019, 9:28am UTC](https://discuss.elastic.co/t/matching-finding-keywords-in-an-already-parsed-field-via-grok/171999/4 "2019-04-12T09:28:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.