# Matching word inside message field

**URL:** <https://discuss.elastic.co/t/matching-word-inside-message-field/36843>\
**Category:** Logstash\
**Created:** [December 10, 2015, 8:09am UTC](https://discuss.elastic.co/t/matching-word-inside-message-field/36843 "2015-12-10T08:09:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bernstein](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@Bernstein](https://discuss.elastic.co/u/Bernstein)\
**Post date:** [December 10, 2015, 8:09am UTC](https://discuss.elastic.co/t/matching-word-inside-message-field/36843/1 "2015-12-10T08:09:55Z")

</div>

Hi, Guys  
Just like many others i am quite new to ELK and have a question.

My logstash recieves syslogs from pfsense firewall.  
I crated a grok filter that parses firewall events and extract all needed data from @message, based on tokens position.  
Now, i want openvpn logs to be parsed as well, but.. structure of the @message is quite different, so i need to create a new portion of grok, that will mess with openvpn logs.

The question is, how can i create logic, that will search for specific word inside the message and then apply grok filter.  
And (!) if word not found - then apply different filter?

- i saw that in previous versions of logstash was grep filter, but it's discontinued for now.. am i right?

\*\* Another thing, that i will be greatly thankful if someone knows is- how can i point directly to specific token inside the message and then bind it to a var. just like tokens\delims thing.

Any suggestion will be highly appreciated!  
Thanks in advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 10, 2015, 10:22am UTC](https://discuss.elastic.co/t/matching-word-inside-message-field/36843/2 "2015-12-10T10:22:03Z")

</div>

> I crated a grok filter that parses firewall events and extract all needed data from @message, based on tokens position.

I assume you mean `message` and not `@message`. The field hasn't been called `@message` for years.

> The question is, how can i create logic, that will search for specific word inside the message and then apply grok filter.  
> And (!) if word not found - then apply different filter?

> **[Accessing event data and fields | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)**

> i saw that in previous versions of logstash was grep filter, but it's discontinued for now.. am i right?

Yes, don't use it.

> Another thing, that i will be greatly thankful if someone knows is- how can i point directly to specific token inside the message and then bind it to a var. just like tokens\delims thing.

I don't understand this question.

---

<div class="post-metadata">

**Author:** ![Bernstein](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@Bernstein](https://discuss.elastic.co/u/Bernstein)\
**Post date:** [December 10, 2015, 12:40pm UTC](https://discuss.elastic.co/t/matching-word-inside-message-field/36843/3 "2015-12-10T12:40:47Z")

</div>

Hi and thanks for replying.

> [@magnusbaeck](#):
>
> I don't understand this question.

message: \<134\>Dec 10 04:36:44 filterlog: 10,16777216,,1000000103,igb1,match,block,in,4,0x0,,128,32285,0,DF,17,udp,78,10.10.10.10,10.10.11.11,51949,137,58

currently i'm using something like this:  
match =\> { "message" =\> "%{INT:a},%{INT:b},,%{INT:c},%{WORD:Interface},%{WORD:match},%{WORD:action},%{WORD:direction},%{INT:d},%{WORD:e},,%{INT:f},%{INT:g},%{INT:h},%{WORD:i},%{INT:protocol\_number},%{WORD:Protocol},%{INT:j},%{IPV4:destination},%{IPV4:source},%{INT:source\_port},%{INT:destination\_port}" }

- i'm sure that's not the best way to do things

So, the question is, how can i point to specific word, based on it's position inside the message, instead of binding every part of it to something.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 10, 2015, 12:59pm UTC](https://discuss.elastic.co/t/matching-word-inside-message-field/36843/4 "2015-12-10T12:59:50Z")

</div>

You should use the [csv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/matching-word-inside-message-field/36843/5 "2017-07-06T05:19:06Z")

</div>