# Parse text value from message but keep original text in message
**URL:** https://discuss.elastic.co/t/parse-text-value-from-message-but-keep-original-text-in-message/121263
**Category:** Logstash
**Created:** [February 23, 2018, 6:06pm UTC](https://discuss.elastic.co/t/parse-text-value-from-message-but-keep-original-text-in-message/121263 "2018-02-23T18:06:49Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@byoungman](https://discuss.elastic.co/u/byoungman)
#### Post date: [February 23, 2018, 6:06pm UTC](https://discuss.elastic.co/t/parse-text-value-from-message-but-keep-original-text-in-message/121263/1 "2018-02-23T18:06:49Z")
Good Afternoon All,
I am currently using the Logstash Grok filter to parse out values from a log entry and populate index fields with the values and it is working like a champ but now I want to parse out certain values from the log input to use in new index fields but keep the original value in the input string.
Is there a way to use Grok parsing to accomplish this or is there another Logstash filter that will provide me the functionality I desire?
TIA,
Bill Youngman
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 23, 2018, 6:17pm UTC](https://discuss.elastic.co/t/parse-text-value-from-message-but-keep-original-text-in-message/121263/2 "2018-02-23T18:17:37Z")
> [@byoungman](#):
>
> but now I want to parse out certain values from the log input to use in new index fields but keep the original value in the input string
grok does not modify its input, so this should be what you are getting now. Can you show what your input line looks like, what your config is and explain what you want to be different?
---
### Author:  [@byoungman](https://discuss.elastic.co/u/byoungman)
#### Post date: [February 23, 2018, 6:53pm UTC](https://discuss.elastic.co/t/parse-text-value-from-message-but-keep-original-text-in-message/121263/3 "2018-02-23T18:53:15Z")
This is going to be rather lengthy but here goes - removing specific information concerning our environment...
This is the original log message...
$$ START $$
Time stamp: 18/02/23 13:20:06.058
Log level: OPS
Thread name: main priority: 5
Class: _'java class name'_
**Application Name** : Data Extract
Application Version: 8.0.1.1.3
**Partition** : System
vertex\_common: 8.0.1.1.1
vertex\_util: 8.0.1.0.3
vertex\_taxgis: 8.0.1.1.1
vertex\_tps\_calc\_impl: 8.0.1.1.6
vertex\_tps\_ccc\_impl: 8.0.1.1.1
Vertex Root: ..
Configuration File: file:_/xx/xxxxxx/xxxxx/xxx/../config/xxx.cfg_
Operating System: Windows Server 2012 R2 6.3 (amd64)
Java Home: xxx
JVM: Oracle Corporation 1.8.0\_121
Max Heap Size: xxx
This is my grok filter--
```
grok {
match => { "message" => "Time stamp:\s%{DATESTAMP:logTime}.*Log level:\s%{WORD:logLevel}.*\sThread name:\s%{GREEDYDATA:logThread}.*\sClass:\s%{JAVACLASS:logClass}(.*Exception classification:\s%{WORD:logExceptionClassification})?.*?\n\s%{GREEDYDATA:logMessage}" }
}
```
Here is the parsed outputs...
**logClass** : _'java class name'_
**logLevel** : OPS
**logThread** : main priority: 5
**logMessage** :
Application Name: Data Extract
Application Version: 8.0.1.1.3
Partition: System
vertex\_common: 8.0.1.1.1
vertex\_util: 8.0.1.0.3
vertex\_taxgis: 8.0.1.1.1
vertex\_tps\_calc\_impl: 8.0.1.1.6
vertex\_tps\_ccc\_impl: 8.0.1.1.1
Vertex Root: ..
Configuration File: file:_/xx/xxxxxx/xxxxx/xxx/../config/xxx.cfg_
Operating System: Windows Server 2012 R2 6.3 (amd64)
Java Home: xxx
JVM: Oracle Corporation 1.8.0\_121
Max Heap Size: xxx
What I would like to do is parse out 'Partition' & 'Application Name' into 2 new index fields but also leave them in the **logMessage** field so it would be like this...
**logApplicationName** : Data Extract
**logPartition** : System
**logMessage** :
Application Name: Data Extract
Application Version: 8.0.1.1.3
Partition: System
vertex\_common: 8.0.1.1.1
vertex\_util: 8.0.1.0.3
vertex\_taxgis: 8.0.1.1.1
vertex\_tps\_calc\_impl: 8.0.1.1.6
vertex\_tps\_ccc\_impl: 8.0.1.1.1
Vertex Root: ..
Configuration File: file:_/xx/xxxxxx/xxxxx/xxx/../config/xxx.cfg_
Operating System: Windows Server 2012 R2 6.3 (amd64)
Java Home: xxx
JVM: Oracle Corporation 1.8.0\_121
Max Heap Size: xxx
Let know if this isn't descriptive enough.
Also the '$$ START $$' log entry is being filtered out by Filebeat.
Thanks,
Bill
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 23, 2018, 6:59pm UTC](https://discuss.elastic.co/t/parse-text-value-from-message-but-keep-original-text-in-message/121263/4 "2018-02-23T18:59:57Z")
Oh, absolutely, you can just use a second grok filter. You have a single multi-line "message" from which you have groked logMessage, so you can just grok that field. In case the order of lines every changes I would anchor on the field name and then grab zero or more not-newline followed by a newline...
```auto
grok {
match => { "logMessage" => "cation Name:\s(?[^
]*)
" }
}
```
It might be possible to do this in a single grok using nested capture groups, but that is going to be much harder to read even if it works.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2018, 6:59pm UTC](https://discuss.elastic.co/t/parse-text-value-from-message-but-keep-original-text-in-message/121263/5 "2018-03-23T18:59:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.