# Need help in combining few grok

**URL:** <https://discuss.elastic.co/t/need-help-in-combining-few-grok/85647>\
**Category:** Logstash\
**Created:** [May 13, 2017, 1:50pm UTC](https://discuss.elastic.co/t/need-help-in-combining-few-grok/85647 "2017-05-13T13:50:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cooling](https://avatars.discourse-cdn.com/v4/letter/c/4da419/32.png) [@cooling](https://discuss.elastic.co/u/cooling)\
**Post date:** [May 13, 2017, 1:50pm UTC](https://discuss.elastic.co/t/need-help-in-combining-few-grok/85647/1 "2017-05-13T13:50:09Z")

</div>

Hi,

I have the log entry and the grok pattern as below.

Log:

> 2017-04-11 18:31:41,938 | INFO | 195 | Process | Bundle Name | logStr: GUID: dl99X/WeN77E2SmyjH9uS1Fy+EDvFQ5R\_939bae | ReferenceID: 20170411183141500676 | InstanceID: 70411183141906430422429270016 | ChannelID: EXAMPLE | System: EXAMPLE | ServiceName: EXAMPLE | InvocationPoint: inbound

> 2017-04-11 18:31:42,743 | INFO | 193 | API | Bundle Name | Outbound Message | RESPONSE=[GUID=[dl99X/WeN77E2SmyjH9uS1Fy+EDvFQ5R\_939bae], InstanceID=[70411183141906430422429270016], logStr=[GUID: dl99X/WeN77E2SmyjH9uS1Fy+EDvFQ5R\_939bae | ReferenceID: 20170411183141500676 | InstanceID: 70411183141906430422429270016 | ChannelID: EXAMPLE | System: EXAMPLE | ServiceName: EXAMPLE | InvocationPoint: inbound

Grok pattern:

> grok {  
> #grok general pattern  
> match =\> {  
> "message" =\> "%{TIMESTAMP\_ISO8601:logdate}%{SPACE}|%{SPACE}%{LOGLEVEL:level}%{SPACE}|%{SPACE}%{DATA:thread}%{SPACE}|%{SPACE}%{DATA:serviceName}%{SPACE}|%{SPACE}%{DATA:bundle}%{SPACE}|%{SPACE}%{GREEDYDATA:logdetails}"  
> }  
> }   
> #Grok to get GUID  
> grok {  
> match =\> {  
> "logdetails" =\> "(?\<=GUID:).%{DATA:guid}(?=\s)"   
> }  
> }  
> #Grok to get ChannelID  
> grok {  
> match =\> {  
> "logdetails" =\> "(?\<=ChannelID:).%{DATA:channelID}(?=\s)"   
> }  
> }  
> #Grok to get ReferenceID  
> grok {  
> match =\> {  
> "logdetails" =\> "(?\<=ReferenceID:).%{DATA:referenceID}(?=\s)"   
> }  
> }

As you all can see, I have few separate grok to just get the GUID, ChannelID and ReferenceID.  
I am asking for help if anyone has any idea to combine/ make my grok more efficient.

Thank you in advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 15, 2017, 5:30am UTC](https://discuss.elastic.co/t/need-help-in-combining-few-grok/85647/2 "2017-05-15T05:30:04Z")

</div>

Why not use a kv filter for parsing the key/value pairs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2017, 5:42am UTC](https://discuss.elastic.co/t/need-help-in-combining-few-grok/85647/3 "2017-06-12T05:42:33Z")

</div>

Closed on June 12, 2017, 5:42am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.