# Parsing logs for specific domain

**URL:** <https://discuss.elastic.co/t/parsing-logs-for-specific-domain/46445>\
**Category:** Logstash\
**Created:** [April 5, 2016, 7:01pm UTC](https://discuss.elastic.co/t/parsing-logs-for-specific-domain/46445 "2016-04-05T19:01:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![himanshudas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/himanshudas/32/8909_2.png) [@himanshudas](https://discuss.elastic.co/u/himanshudas)\
**Post date:** [April 5, 2016, 7:01pm UTC](https://discuss.elastic.co/t/parsing-logs-for-specific-domain/46445/1 "2016-04-05T19:01:59Z")

</div>

I want to parse HAPROXY logs for specific domain(below: abc refers to [abc.com](http://abc.com)) using logstash.This is the filter that i am trying to use inside logstash input:

input {  
filter {  
if [message] =~ "abc" {  
grok {  
match =\> ["message", .......

On the above config, i am specifying to filter logs with abc, however, this doesn't seems to be effective, when i see on ES index, I get to see logs parsed for all different domains along with [abc.com](http://abc.com), which I don't want.

I want logs only for specific domains(say [abc.com](http://abc.com) to be indexed into ES) and ignore everything apart from  
[abc.com](http://abc.com)

Any help would be appreciated here.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 5, 2016, 8:01pm UTC](https://discuss.elastic.co/t/parsing-logs-for-specific-domain/46445/2 "2016-04-05T20:01:40Z")

</div>

The syntax is

```
if [message] =~ /abc/ {

```

but I'd prefer to unconditionally parse the event with grok and throw it away unless the extracted domain field matches the interesting domain name. Otherwise you'll parse messages that happen to contain that domain name in other parts (although that could be very unlikely).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/parsing-logs-for-specific-domain/46445/3 "2017-07-06T05:03:44Z")

</div>