# Please suggest me the filter/expression to be used for the event to metric data format conversion

**URL:** <https://discuss.elastic.co/t/please-suggest-me-the-filter-expression-to-be-used-for-the-event-to-metric-data-format-conversion/153683>\
**Category:** Logstash\
**Created:** [October 23, 2018, 9:05pm UTC](https://discuss.elastic.co/t/please-suggest-me-the-filter-expression-to-be-used-for-the-event-to-metric-data-format-conversion/153683 "2018-10-23T21:05:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ArunGan](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@ArunGan](https://discuss.elastic.co/u/ArunGan)\
**Post date:** [October 23, 2018, 9:05pm UTC](https://discuss.elastic.co/t/please-suggest-me-the-filter-expression-to-be-used-for-the-event-to-metric-data-format-conversion/153683/1 "2018-10-23T21:05:55Z")

</div>

I am trying to convert my event logs into influx protocol format using GROK filter. So i am trying to come up with a GROK filter to convert the below log .

For example:,

Input event log(From a node to log-stash) :  
55.3.244.1 GET /index.html 15824 0.043

Log-stash Output (After applying GROK Filter):  
responseTime, \_blossom\_id=abc, host=55.3.244.1 timeTaken=0.043 1465839830100400200

I couldn't come up with a GROK filter that can do this conversion. Can someone please help me with this conversion ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2018, 9:05pm UTC](https://discuss.elastic.co/t/please-suggest-me-the-filter-expression-to-be-used-for-the-event-to-metric-data-format-conversion/153683/2 "2018-11-20T21:05:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.