# Need help with Grok
**URL:** https://discuss.elastic.co/t/need-help-with-grok/189146
**Category:** Logstash
**Created:** [July 5, 2019, 5:43pm UTC](https://discuss.elastic.co/t/need-help-with-grok/189146 "2019-07-05T17:43:16Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@EvanG](https://discuss.elastic.co/u/EvanG)
#### Post date: [July 5, 2019, 5:43pm UTC](https://discuss.elastic.co/t/need-help-with-grok/189146/1 "2019-07-05T17:43:16Z")
Hey Guys,
New to Logstash, and I tried to read the documentation as much as possible but still confused..
Can anyone help me grok 'sessionId' and 'user' out of this message? Trying to get the values into new fields.
I know its JSON data, but we are treating it as string for now.
`{"data":{"type":"external features","event":"App started"},"House":"44 King St","sessionId":"43-22-33","timestamp":"2019-07-04T23:58:40.405Z","type":"externalFeature","user":"155"}`
Thank you!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 5, 2019, 6:09pm UTC](https://discuss.elastic.co/t/need-help-with-grok/189146/2 "2019-07-05T18:09:10Z")
I would definitely use a json filter rather than grok, but if you insist...
```
grok {
match => { "message" => ['"user":"%{NUMBER:user}"', '"sessionId":"(?[^"]+)"' ] }
break_on_match => false
}
```
---
### Author:  [@EvanG](https://discuss.elastic.co/u/EvanG)
#### Post date: [July 5, 2019, 6:26pm UTC](https://discuss.elastic.co/t/need-help-with-grok/189146/3 "2019-07-05T18:26:02Z")
Thanks Badger,
works well. The reason why I was hesitant to go with a JSON filter, is because there's characters in front of the JSON that were causing parsing errors, and I wasn't quite sure how to trim them.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 5, 2019, 6:33pm UTC](https://discuss.elastic.co/t/need-help-with-grok/189146/4 "2019-07-05T18:33:41Z")
You might be able to do it using mutate+gsub. For example if the additional characters never contain { then you could use
```
mutate { gsub => ["message", '^[^{]+{\s*"', '{"' ] }
```
That allows for optional whitespace between the { and the first "
---
### Author:  [@EvanG](https://discuss.elastic.co/u/EvanG)
#### Post date: [July 5, 2019, 6:39pm UTC](https://discuss.elastic.co/t/need-help-with-grok/189146/5 "2019-07-05T18:39:14Z")
Awesome , yeah that should work too! thanks again
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2019, 6:39pm UTC](https://discuss.elastic.co/t/need-help-with-grok/189146/6 "2019-08-02T18:39:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.