# Parsing plain text with Logstash filter

**URL:** https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085
**Category:** Logstash
**Created:** [June 12, 2017, 5:15pm UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085 "2017-06-12T17:15:04Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![John\_06](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@John\_06](https://discuss.elastic.co/u/John_06)
#### Post date: [June 12, 2017, 5:15pm UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085/1 "2017-06-12T17:15:04Z")

</div>

The log file is one line of plain text. There is part of text like this:

`...there is some text here, Results: 0, Errors: 0, there is some text here...`

The goal is to create new fields `results` and `errors` and assign proper values to them.

I think it can be achieved by doing something like this in Logstash filter section:

```
filter {
  grok {
    match => {"message" => "(?<results>Results:) (?<errors>Errors:)"}
  }
  mutate {
    add_field => { "results" => "%{results}" }
  }
  mutate {
    add_field => { "errors" => "%{Errors}" }
  }
}

```

Could anybody suggest the right way to solve that problem?

---

<div class="post-metadata">

### Author: ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)
#### Post date: [June 12, 2017, 7:12pm UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085/2 "2017-06-12T19:12:07Z")

</div>

Hi

You could try:

```
filter {
    if [message] =~ /.*Results.*Errors.*/ {
        grok {
            match => { "message" => ".*Results\:\s(?<results>\d*).*Errors\:\s(?<Errors>\d*)"
         }
    }
}

```

That should get you fields and values for results and errors as strings. If you need those values as numbers just use Mutate's convert function.

---

<div class="post-metadata">

### Author: ![John\_06](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@John\_06](https://discuss.elastic.co/u/John_06)
#### Post date: [June 12, 2017, 9:05pm UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085/3 "2017-06-12T21:05:09Z")

</div>

@Kryten That didn't work.

The part of the message is:

`...:, , Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, , [INFO]...`

This is config:

```
filter {
  if [message] =~ /.*Failures.*Errors.*Skipped.*/ {
    grok {
      match => {"message" => ".*Failures\:\s(?<failures>\d*).*Errors\:\s(?<errors>\d*).*Skipped\:\s(?<skipped>\d*)"}
    }
  }
}

```

No new fields have been created.

---

<div class="post-metadata">

### Author: ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)
#### Post date: [June 12, 2017, 10:04pm UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085/4 "2017-06-12T22:04:14Z")

</div>

@John_06

If you take the string you supplied as sample to begin with:

`...there is some text here, Results: 0, Errors: 0, there is some text here...`

and put it into the grok debugger here:-  
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

Then paste in the pattern I supplied:  
`.*Results\:\s(?<results>\d*).*Errors\:\s(?<Errors>\d*)`

You get fields. LS would do the same.

If you then remove the event string from your first post and replace it with the event string from your last, it breaks. Naturally.

To parse the latest event string you provided:-  
`...:, , Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, , [INFO]...`

You could use:  
`.*run\:\s(?<run>\d*).*Failures\:\s(?<failures>\d*).*Errors\:\s(?<errors>\d*).*Skipped\:\s(?<skipped>\d*).*\[(?<severity>\w*)`

and that should yield:  
{  
"run": [  
[  
"1"  
]  
],  
"failures": [  
[  
"0"  
]  
],  
"errors": [  
[  
"0"  
]  
],  
"skipped": [  
[  
"0"  
]  
],  
"severity": [  
[  
"INFO"  
]  
]  
}

---

<div class="post-metadata">

### Author: ![John\_06](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@John\_06](https://discuss.elastic.co/u/John_06)
#### Post date: [June 13, 2017, 4:39pm UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085/5 "2017-06-13T16:39:13Z")

</div>

Thanks. A little unclear how to handle the case when those variables are repeatable in log message.

E.g.:

```
...created, Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, there is some text here Results:, , Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, , [INFO]...

```

The grok filter expression:

`.*run\:\s(?<run>\d*).*Failures\:\s(?<failures>\d*).*Errors\:\s(?<errors>\d*).*Skipped\:\s(?<skipped>\d*)`

will create fields with two values: run 1, 1; failures 0, 0; errors 0, 0; skipped 0, 0.  
Is it possible to get only only value for every field?

---

<div class="post-metadata">

### Author: ![John\_06](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@John\_06](https://discuss.elastic.co/u/John_06)
#### Post date: [June 15, 2017, 3:03am UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085/6 "2017-06-15T03:03:30Z")

</div>

@magnusbaeck  
Hi Magnus, do you have any thoughts why grok filter assigns to values to the same field?  
Though everything works good in Grok debugger - it shows only one value for every field.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2017, 3:03am UTC](https://discuss.elastic.co/t/parsing-plain-text-with-logstash-filter/89085/7 "2017-07-13T03:03:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.