Regex on matched field

[prateek_shrivastava]

I have a grok filter which is:

grok {
		  match => [ "message", "^(\s+)?%{TIMESTAMP_ISO8601:logtime}%{SPACE}\|%{SPACE}\[%{NUMBER:thread_id}\]%{SPACE}\|%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\|%{SPACE}%{GREEDYDATA:classname}%{SPACE}\|%{SPACE}%{GREEDYDATA:logmessage}"]  
	   }

Now I further want to apply regex on classname and do furthur classification. How can I do that?

[paz]

This basically tells us nothing. What's an example entry of the classname field?

In principle, you can have another grok filter further down the line that only applies to that field.