Multiple grok matching fileds

[magnusbaeck (Magnus Bäck)]

This is basically the exact same question as the one below. Perhaps we can keep the discussions together.

Create new field based on msg filed in logstash

Hi All, Here i want to create a new field Invoice_IID based on msg filed, contains Invoice_IID value in log line msg filed. "msg" => "Finished Creating Parent Invoices for Invoice_IID: 80000000-41fb-1638-cd42-ffff08d24480" My configuration is: filter { grok { match => { "message" => "%{TIMESTAMP_ISO8601:time} \[%{NUMBER:thread}\] %{LOGLEVEL:loglevel} %{JAVACLASS:class} - %{GREEDYDATA:msg}" } } if "Invoice_IID" in [msg] { mutate { add_field => { "Invoice_IID" => "%{msg}" } } } } Th…