# Quick Question on Grok and filtering

**URL:** <https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147>\
**Category:** Logstash\
**Created:** [April 23, 2018, 4:38pm UTC](https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147 "2018-04-23T16:38:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![F\_Terrie](https://avatars.discourse-cdn.com/v4/letter/f/cdc98d/32.png) [@F\_Terrie](https://discuss.elastic.co/u/F_Terrie)\
**Post date:** [April 23, 2018, 4:38pm UTC](https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147/1 "2018-04-23T16:38:19Z")

</div>

Basically I'm wondering if the below is sound enough to work and if it is efficient to what I need,

The three logs I'm currently running through Logstash doesn't have a unique type and only has a unique host value. I wan't to start using Grok to create unique fields however I'm not sure whats the best way to approach parsing one of the three logs using the simple Grok expression below. Is it possible to use a condition based on the hosts IP? I'll need to create a unique Grok expression for each of the three, however I want to start with one at the moment to get more familiar with Grok. Is this do able?

Any help would be greatly appreciated 👍

```
  filter {
      if "KeyWord" in [message] {
    	grok {
            match => { "message" => "%{IP:ip} <9>1 %{TIMESTAMP_ISO8601:timezone} %{WORD:id} %{WORD:log_type} - -%{GREEDYDATA:message}"}
            	}
    	}
    }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 23, 2018, 6:44pm UTC](https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147/2 "2018-04-23T18:44:19Z")

</div>

> [@F\_Terrie](#):
>
> if "KeyWord" in [message] {

in tests for membership in an array. If you want to test whether the message field contains that word then

```auto
if [message] =~ /\bKeyWord\b/

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 23, 2018, 8:42pm UTC](https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147/3 "2018-04-23T20:42:36Z")

</div>

> in tests for membership in an array.

It can also be used for substring matching.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2018, 8:51pm UTC](https://discuss.elastic.co/t/quick-question-on-grok-and-filtering/129147/4 "2018-05-21T20:51:44Z")

</div>

Closed on May 21, 2018, 8:51pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.