# Parsing string and assigning fields
**URL:** https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086
**Category:** Logstash
**Created:** [June 27, 2016, 10:01pm UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086 "2016-06-27T22:01:07Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@apomerenk](https://discuss.elastic.co/u/apomerenk)
#### Post date: [June 27, 2016, 10:01pm UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/1 "2016-06-27T22:01:07Z")
How would I use a logstash filter to parse the message:
0.00 pool 3041
and assign fields CPU\_USAGE, PROCESS\_NAME, and PROCESS\_ID to it? For example
CPU\_USAGE: 0.00 (type float)
PROCESS\_NAME: pool (type string)
PROCESS\_ID: 3041 (type float)
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 28, 2016, 6:25am UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/2 "2016-06-28T06:25:17Z")
Untested example that assumes that the string you want to parse is stored in the `message` field and that the process id is an integer and not a float:
```auto
grok {
match => {
"message" => "^%{NUMBER:CPU_USAGE:float} %{NOTSPACE:PROCESS_NAME} %{INT:PROCESS_ID:int}$"
}
}
```
---
### Author:  [@apomerenk](https://discuss.elastic.co/u/apomerenk)
#### Post date: [June 28, 2016, 12:55pm UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/3 "2016-06-28T12:55:15Z")
That is giving a grok\_parse\_failure with none of the newly created fields showing up.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 28, 2016, 1:24pm UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/4 "2016-06-28T13:24:06Z")
Please add a `stdout { codec => rubydebug }` output and show the results.
---
### Author:  [@apomerenk](https://discuss.elastic.co/u/apomerenk)
#### Post date: [June 28, 2016, 1:35pm UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/5 "2016-06-28T13:35:36Z")
one parse:
```
{
"message" => "0.00 colord 2924",
"@version" => "1",
"@timestamp" => "2016-06-28T13:34:37.553Z",
"beat" => {
"hostname" => ************ ,
"name" => ************
},
"source" => ********* ,
"input_type" => "log",
"count" => 1,
"fields" => nil,
"offset" => 806707,
"type" => "log",
"host" => **********
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_grokparsefailure"
]
}
```
And the filter I'm using
```
input {
beats{
port => 5044
}
}
filter {
grok {
match => {
"message" => "^%{NUMBER:CPU_USAGE:float} %{NOTSPACE:PROCESS_NAME} %{INT:PROCESS_ID:int}$"
}
}
}
output {
stdout{
codec => rubydebug
}
elasticsearch{
}
}
```
---
### Author:  [@apomerenk](https://discuss.elastic.co/u/apomerenk)
#### Post date: [June 28, 2016, 2:15pm UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/6 "2016-06-28T14:15:34Z")
Looking at my original post, the message would contain a lot more whitespace between characters like:
`"0.00 _________pool_________ 3041"`
with underscores being spaces
---
### Author:  [@apomerenk](https://discuss.elastic.co/u/apomerenk)
#### Post date: [June 28, 2016, 2:19pm UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/7 "2016-06-28T14:19:47Z")
Stripping the extra white space on the log generator made it work. Thanks for the help!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 30, 2016, 7:24am UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/8 "2016-06-30T07:24:45Z")
You could of course also have adjusted the grok expression to accept more than one space.
This shows why it's crucial to pay attention to formatting details when posting questions. Formatting text as code is usually enough.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/parsing-string-and-assigning-fields/54086/9 "2017-07-06T04:50:12Z")