# Problem with Grok filter with my logfile

**URL:** <https://discuss.elastic.co/t/problem-with-grok-filter-with-my-logfile/51420>\
**Category:** Logstash\
**Created:** [May 31, 2016, 11:34am UTC](https://discuss.elastic.co/t/problem-with-grok-filter-with-my-logfile/51420 "2016-05-31T11:34:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yde](https://avatars.discourse-cdn.com/v4/letter/y/8e7dd6/32.png) [@yde](https://discuss.elastic.co/u/yde)\
**Post date:** [May 31, 2016, 11:34am UTC](https://discuss.elastic.co/t/problem-with-grok-filter-with-my-logfile/51420/1 "2016-05-31T11:34:16Z")

</div>

Hello everybody,

I am new here, I am actually trying to understand how works filebeat, logstack, elastic and kibana.  
I am actually testing the logstack module and i am actually blocked, I don't understand how i can extract from the log file the information i need. (below is my log i receive)

I want to extract some information from the log and i don't know how to do that with the grok filter.

I am trying to take from the log "clamart" and put it in a field "text"  
also  
I am trying to take from the log "uas%5Fintranetedf%2B" and put it in a field "database"

21/04/2016 17:11:53 [7] action=QUERY&outputencoding=UTF8&xmlmeta=true&querysummary=true&minscore=20&securityinfo=mPHP&databasematch=uas%5Fintranetedf%2B&combine=simple&predict=false&sort=Relevance&timeoutms=20000&languagetype=frenchUTF8&anylanguage=true&start=1&maxresults=10&totalresults=true&summary=context&characters=260&highlight=summaryterms&text=clamart&fieldtext=BIASVAL%7Bfr%5FFR%2C1%7D%3ABIAS%5FFIELD1%2BAND%2BBIASVAL%7BGed%20Direction%20Groupe%2C%2D20%7D%3AF7 (127.0.0.1)

Maybe it is not the good filter to use ?

If someone can give me an advice, i will be great

Yves

---

<div class="post-metadata">

**Author:** ![yde](https://avatars.discourse-cdn.com/v4/letter/y/8e7dd6/32.png) [@yde](https://discuss.elastic.co/u/yde)\
**Post date:** [May 31, 2016, 12:57pm UTC](https://discuss.elastic.co/t/problem-with-grok-filter-with-my-logfile/51420/2 "2016-05-31T12:57:00Z")

</div>

Ok il think ifound the way to implement what i am trying to do.

I need to create custom pattern which looks like this.

filter {  
grok {  
match =\> { "message" =\> "databasematch=(?(([^?&]_)))._&text=(?(([^?&]\*)))" }  
}  
}

Maybe, it is not the best regex but it's working and i have understood how to do it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/problem-with-grok-filter-with-my-logfile/51420/3 "2017-07-06T04:55:13Z")

</div>