# Need help for writting Nested Parser **URL:** \ **Category:** Logstash\ **Tags:** painless\ **Created:** [May 17, 2020, 5:50pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007 "2020-05-17T17:50:07Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Rohit\_Kumbhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohit_kumbhar/32/67682_2.png) [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Post date:** [May 17, 2020, 5:50pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/1 "2020-05-17T17:50:08Z")
Hey , I need some help for writing Nested Parser for following log, its has the same type , field of logs from beginning in the middle of current log. see yourself `174>ABC Firewall: 17May2020 23:09:18 5 N/A 5 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: 17May2020 23:09:15 5 N/A 16 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: 17May2020 23:09:11 5 N/A 20 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: 17May2020 23:09:08 5 N/A 52 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: (+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; Prod` Please Help needed on urgent basis thanks in advance ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 17, 2020, 6:12pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/2 "2020-05-17T18:12:03Z")
I would break off the initial section with dissect, then chop up the rest using a kv filter. ---
**Author:** ![Rohit\_Kumbhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohit_kumbhar/32/67682_2.png) [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Post date:** [May 17, 2020, 6:26pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/3 "2020-05-17T18:26:13Z")
@Badger I have tried Using grok and KV filter But in from this field `default_device_message: <174>Firewall:` on words the message starts again and the value for the field `default_device_message: ` is `default_device_message: <174>Firewall: 17May2020 23:09:15 5 N/A 16 IP > N/A LogId: ` this is because kv is searching for `;`as next field separator and that is my main problem ANY Suggestion would be highly appreciated . Thank you ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 17, 2020, 7:00pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/4 "2020-05-17T19:00:42Z")
> [@Rohit\_Kumbhar](#): > > the field `default_device_message: ` is ... That looks right. What would you like it to be instead of that? ---
**Author:** ![Rohit\_Kumbhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohit_kumbhar/32/67682_2.png) [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Post date:** [May 17, 2020, 7:31pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/5 "2020-05-17T19:31:31Z")
@Badger I want rest all after `default_device_message:` as a value so i can again parse it using grok and further more. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 17, 2020, 11:14pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/6 "2020-05-17T23:14:46Z")
Sorry I still do not understand what value you want the default\_device\_message to have. Can you copy and paste the string that you want it have as its value? ---
**Author:** ![Rohit\_Kumbhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohit_kumbhar/32/67682_2.png) [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Post date:** [May 18, 2020, 6:41am UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/7 "2020-05-18T06:41:09Z")
@Badger I want this `default_device_message: <174>Firewall: 17May2020 23:09:15 5 N/A 16 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: 17May2020 23:09:11 5 N/A 20 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: 17May2020 23:09:08 5 N/A 52 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: (+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; Prod` `default_device_message` field Name and `<174>Firewall: 17May2020 23:09:15 5 N/A 16 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: 17May2020 23:09:11 5 N/A 20 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: 17May2020 23:09:08 5 N/A 52 IP > N/A LogId: ; ContextNum: ; OriginSicName: ; default_device_message: <174>Firewall: (+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; ProductName: Syslog; ProductFamily: Network;(+); facility: local use 5; syslog_severity: Informational; Prod` as Value ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 18, 2020, 3:11pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/8 "2020-05-18T15:11:36Z")
OK, so use dissect or grok to parse it, do not use kv. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 15, 2020, 3:11pm UTC](https://discuss.elastic.co/t/need-help-for-writting-nested-parser/233007/9 "2020-06-15T15:11:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.