# Regex on matched field

**URL:** <https://discuss.elastic.co/t/regex-on-matched-field/128839>\
**Category:** Logstash\
**Created:** [April 20, 2018, 9:13am UTC](https://discuss.elastic.co/t/regex-on-matched-field/128839 "2018-04-20T09:13:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![prateek\_shrivastava](https://avatars.discourse-cdn.com/v4/letter/p/82dd89/32.png) [@prateek\_shrivastava](https://discuss.elastic.co/u/prateek_shrivastava)\
**Post date:** [April 20, 2018, 9:13am UTC](https://discuss.elastic.co/t/regex-on-matched-field/128839/1 "2018-04-20T09:13:59Z")

</div>

I have a grok filter which is:

```auto
grok {
		  match => ["message", "^(\s+)?%{TIMESTAMP_ISO8601:logtime}%{SPACE}\|%{SPACE}\[%{NUMBER:thread_id}\]%{SPACE}\|%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\|%{SPACE}%{GREEDYDATA:classname}%{SPACE}\|%{SPACE}%{GREEDYDATA:logmessage}"]  
	   }

```

Now I further want to apply regex on classname and do furthur classification. How can I do that?

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [April 20, 2018, 10:41am UTC](https://discuss.elastic.co/t/regex-on-matched-field/128839/2 "2018-04-20T10:41:26Z")

</div>

This basically tells us nothing. What's an example entry of the _classname_ field?

In principle, you can have another grok filter further down the line that only applies to that field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2018, 10:41am UTC](https://discuss.elastic.co/t/regex-on-matched-field/128839/3 "2018-05-18T10:41:46Z")

</div>

Closed on May 18, 2018, 10:41am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.