# Need for syntax and semantix - GROK filter
**URL:** https://discuss.elastic.co/t/need-for-syntax-and-semantix-grok-filter/298404
**Category:** Kibana
**Created:** [February 28, 2022, 12:59pm UTC](https://discuss.elastic.co/t/need-for-syntax-and-semantix-grok-filter/298404 "2022-02-28T12:59:05Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Clyton](https://discuss.elastic.co/u/Clyton)
#### Post date: [February 28, 2022, 12:59pm UTC](https://discuss.elastic.co/t/need-for-syntax-and-semantix-grok-filter/298404/1 "2022-02-28T12:59:05Z")
Hi All,
I would like to grep the below numeric value before the keyword "DEBUG" from the message field and map it to a new field called OrderID. Kindly let us know the pattern we can apply in order to achieve this context.
message : 375 DEBUG
message : 428 DEBUG
message : 311 DEBUG
message : 580 DEBUG
Expected Output:
OrderID: 375
OrderID: 428
OrderID: 311
OrderID: 580
Regards,
Clyton
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [March 8, 2022, 8:27am UTC](https://discuss.elastic.co/t/need-for-syntax-and-semantix-grok-filter/298404/2 "2022-03-08T08:27:32Z")
Hi
Isn't that a #elastic-stack:logstash question? Or are you using runtime fields?
> **[Runtime fields context | Painless Scripting Language \[8.0\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-runtime-fields-context.html)**
Thx & Best,
Matthias
BTW: In Kibana you can use the grok debugger for that : [Debug grok expressions | Kibana Guide [8.0] | Elastic](https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 5, 2022, 8:28am UTC](https://discuss.elastic.co/t/need-for-syntax-and-semantix-grok-filter/298404/3 "2022-04-05T08:28:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.