# Parse a logfile

**URL:** <https://discuss.elastic.co/t/parse-a-logfile/87284>\
**Category:** Logstash\
**Created:** [May 26, 2017, 5:09pm UTC](https://discuss.elastic.co/t/parse-a-logfile/87284 "2017-05-26T17:09:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aqsyounas](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@aqsyounas](https://discuss.elastic.co/u/aqsyounas)\
**Post date:** [May 26, 2017, 5:09pm UTC](https://discuss.elastic.co/t/parse-a-logfile/87284/1 "2017-05-26T17:09:25Z")

</div>

Hello Community,  
Pardon me for my naive question i am new to elasticsearch and this is my first time posting to this mailing list.

i am try to parse a log file which contains data in format given below.

## connectionGUID=2928A08F-A946-482C-B23E-C7F5470BB73E&source=16463071637&destination=19173417704&transactionGUID=c574cbb9-7794-4602-8b69-41cd0c750487&messageText=&sourceCountry=&sourceCountryCode=1&sourceCountryAbbreviation=US&sourceNational=6463071637&concatenatedMessage=false

## connectionGUID=2928A08F-A946-482C-B23E-C7F5470BB73E&source=19173417704&destination=16463071637&transactionGUID=8fd067ef-e79c-43a0-ab82-e34a0c84a36f&messageText=&sourceCountry=&sourceCountryCode=1&sourceCountryAbbreviation=US&sourceNational=9173417704&concatenatedMessage=false

connectionGUID=2928A08F-A946-482C-B23E-C7F5470BB73E&source=19173417704&destination=16463071637&transactionGUID=202183ea-0c4b-4e71-8a0e-5687b259ad89&messageText=&sourceCountry=&sourceCountryCode=1&sourceCountryAbbreviation=US&sourceNational=9173417704&concatenatedMessage=false

I want this to be search by by using "source,destination,sourceCountryAbbreviation=US"  
like if i search for source=19173417704 all logs with string should be printed in kibana.

Thanks for any pointer.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2017, 6:49pm UTC](https://discuss.elastic.co/t/parse-a-logfile/87284/2 "2017-05-29T18:49:15Z")

</div>

The string you want to parse is a list of key/value pairs. Use a kv filter to parse such strings into discrete fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2017, 6:49pm UTC](https://discuss.elastic.co/t/parse-a-logfile/87284/3 "2017-06-26T18:49:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.