# Optimizing my current GROK Filter
**URL:** https://discuss.elastic.co/t/optimizing-my-current-grok-filter/45289
**Category:** Logstash
**Created:** [March 23, 2016, 11:29pm UTC](https://discuss.elastic.co/t/optimizing-my-current-grok-filter/45289 "2016-03-23T23:29:19Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)
#### Post date: [March 23, 2016, 11:29pm UTC](https://discuss.elastic.co/t/optimizing-my-current-grok-filter/45289/1 "2016-03-23T23:29:19Z")
I am new to GROK work. As of now, I have created a filter which extracts all the data. But I need to extract only the SessionID, Method, RequestURI and Content values only.
This is my request log
EventId : 1, Level : Informational, Message : Request, Payload : [**sessionID** : 43a7be8b-3222-4958-9082-ecc4428f0037] [ipAddress : 172.16.22.88] [method : **POST**] [requestUri : **[https://myserver.my](https://myserver.my),com:4433/MyService/api/click2mob**] [content : **{"callType":"Sales\_Appl","customer":{"firstName":"Service","lastName":"Interceptor","phones":[{"countryCode":"1","areaCode":"612","number":"2221213"}**],"emailAddresses":[{"email":"myinterceptor@bestbuy.com"}]}}] , EventName : RequestInfo, Timestamp : 2016-03-22T04:06:01.4157082Z, ProcessId : 9784, ThreadId : 18768
My Current GROK Filter in Logstash -
%{WORD:Event} %{NOTSPACE:Colons} %{WORD:EventID}%{NOTSPACE:Colons} %{WORD:Level} %{NOTSPACE:Colons} %{WORD:LevelDetail}%{NOTSPACE:Colons} %{WORD:Message} %{NOTSPACE:Colons} %{WORD:Request}%{NOTSPACE:Colons} %{WORD:Payload} %{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: Session} %{NOTSPACE:Colons} %{UUID:SessionID}%{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: IPAddress} %{NOTSPACE:Colons} %{IPORHOST:IP}%{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: Method} %{NOTSPACE:Colons} %{WORD:HTTP\_VERB}%{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: RequestURI} %{NOTSPACE:Colons} %{URI:URL}%{NOTSPACE:Colons}%{WORD: content} %{NOTSPACE:Colons} %{GREEDYDATA:keyvalues}%{NOTSPACE:Colons} %{WORD: EventName} %{NOTSPACE:Colons} %{WORD:RequestInfo}%{NOTSPACE:Colons} %{WORD:IIS\_TimeStamp} %{NOTSPACE:Colons} %{TIMESTAMP\_ISO8601:IIS\_TimeStamp}%{NOTSPACE:Colons} %{WORD: ProcessID} %{NOTSPACE:Colons} %{WORD:Process\_ID}%{NOTSPACE:Colons} %{WORD: ThreadID} %{NOTSPACE:Colons} %{WORD:Thread\_ID}
How can I optimize this query to get only the req. values?
---
### Author:  [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)
#### Post date: [March 27, 2016, 8:02am UTC](https://discuss.elastic.co/t/optimizing-my-current-grok-filter/45289/2 "2016-03-27T08:02:50Z")
Can anyone provide any help on this ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/optimizing-my-current-grok-filter/45289/3 "2017-07-06T05:05:14Z")