# Parsing Text Data from a txt file without Key Value Pair using Grok **URL:** \ **Category:** Logstash\ **Created:** [March 29, 2018, 2:03am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005 "2018-03-29T02:03:46Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [March 29, 2018, 2:03am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/1 "2018-03-29T02:03:46Z")
Hi All, I need help to parse data separated by ' ; ' from a txt file without key value pair using grok. Kindly advice. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 29, 2018, 5:46am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/2 "2018-03-29T05:46:29Z")
Please provide an example of what the data looks like. ---
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [March 29, 2018, 5:52am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/3 "2018-03-29T05:52:24Z")
The data looks like below 2018-03-21;ABC;envint76;deploy\_step;;Deploy OK;;; 2018-03-21;WXYZ;envint725;custom\_tests;ITE;nbrun\_1;1;8; 2018-03-21;DEF;envint76;sanity\_check;ITE;nbrun\_1;0;30; ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 29, 2018, 6:01am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/4 "2018-03-29T06:01:23Z")
As fields seem separated by `;` I would recommend using the [dissect filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) rather than grok. ---
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [March 29, 2018, 8:01am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/5 "2018-03-29T08:01:05Z")
Thanks for your input. Since Logstash is completely new, need assistance on the config. Have tried to create as below. Am not sure about %{msg} mentioned on filter (Should I include it). input { file { path =\> "/home/envdev80/tmp/stats\_SF.txt" start\_position =\> "beginning" } } filter { dissect { mapping =\> { "message" =\> "%{Date};%{Team};%{Environment};%{TypeTests};%{runVersion};%{nbrun\_sanityCount};%{NbErrors},%{total\_count}: %{msg}" } } } Please advice. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 29, 2018, 8:08am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/6 "2018-03-29T08:08:29Z")
> [@vmashok85](#): > > %{NbErrors},%{total\_count}: %{msg} This part does not seem to match the example messages you have shown. Based on the example data I would expect it to look something like this: ```auto "message" => "%{Date};%{Team};%{Environment};%{TypeTests};%{runVersion};%{nbrun_sanityCount};%{NbErrors};%{total_count};%{msg}" ``` ---
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [April 3, 2018, 8:10am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/7 "2018-04-03T08:10:53Z")
Thanks am able to parse the message, but any update of data on the source file stats\_SF.txt is not getting reflected on the Kibana side. Help to advice on how to auto load the updated data onto kibana. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 3, 2018, 8:40am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/8 "2018-04-03T08:40:51Z")
> [@vmashok85](#): > > any update of data on the source file stats\_SF.txt What do you mean by this? Is new data being appended but not processed? ---
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [April 3, 2018, 8:45am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/9 "2018-04-03T08:45:22Z")
yes, new data being appended but not processed automatically. ---
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [April 5, 2018, 12:38pm UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/10 "2018-04-05T12:38:02Z")
am able to process the available data now. I have another query is it possible to split a value (Deploy OK) which was parsed using the dissect filter. I mean I need to split Deploy and OK separated by space into to values for further processing. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 5, 2018, 12:49pm UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/11 "2018-04-05T12:49:03Z")
All processing does not have to be done by a single filter - you can add any number of filters you need to further process the extracted fields. ---
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [April 9, 2018, 8:27am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/12 "2018-04-09T08:27:10Z")
Thanks, regarding auto processing of data available on the text file, unless I reload the index/config file the data's are not getting processed automatically. Please advice how to make the data available on kibana in run time. FYI currently there are multiple config files and we are trying to load all. ---
**Author:** ![vmashok85](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@vmashok85](https://discuss.elastic.co/u/vmashok85)\ **Post date:** [April 13, 2018, 10:22am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/13 "2018-04-13T10:22:58Z")
Can you please help me with a sample filter to achieve below condition. If TypeTests=xyz I need to check the value of nbrun\_sanityCount and split it based on space (Build OK) Currently the filter is as below. filter { dissect { mapping =\> { "message" =\> "%{Date};%{Team};%{Environment};%{TypeTests};%{runVersion};%{nbrun\_sanityCount};%{NbErrors};%{total\_count};%{msg}" periodic\_flush =\> true } } } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 11, 2018, 10:24am UTC](https://discuss.elastic.co/t/parsing-text-data-from-a-txt-file-without-key-value-pair-using-grok/126005/14 "2018-05-11T10:24:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.