# Regex Pattern to fetch field from message

**URL:** https://discuss.elastic.co/t/regex-pattern-to-fetch-field-from-message/320563
**Category:** Logstash
**Created:** [December 6, 2022, 10:41am UTC](https://discuss.elastic.co/t/regex-pattern-to-fetch-field-from-message/320563 "2022-12-06T10:41:54Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [December 6, 2022, 10:41am UTC](https://discuss.elastic.co/t/regex-pattern-to-fetch-field-from-message/320563/1 "2022-12-06T10:41:55Z")

</div>

HI Team,  
I'm trying to fetch some key field from my message and i need pattern to match exact keyword.

i need UserID and User agent matching pattern

`[INFO] 2022-12-05 17:20:45:409 Logger - 365 Service Request: <mark>UserID</mark>: 115329, UserAgent: Mozilla/5.0 (Linux; Android 8.0.0; SM-A600FN Build/R16NW; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/107.0.5304.105 Mobile Safari/537.36 [edgeConnectSmartHybrid], sessionId: _kQVyP0iodE4jj8KJumr6Wd7C59X0FsVpZoE9j22, ipAddress: xx.xx.xx.xx, serverId: 1-1, Invoking method: getHasAccountForROIFunctions on object, class:Customer`

---

<div class="post-metadata">

### Author: ![rowish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rowish/32/98815_2.png) [@rowish](https://discuss.elastic.co/u/rowish)
#### Post date: [December 20, 2022, 9:14pm UTC](https://discuss.elastic.co/t/regex-pattern-to-fetch-field-from-message/320563/2 "2022-12-20T21:14:55Z")

</div>

Assuming that you are looking for a base 10 number and an irregular text string respectively, this grok works for your given sample:

```auto
grok {
       match => {"message" => "\A%{GREEDYDATA}UserID</mark>: (?<userId>%{BASE16NUM}|), UserAgent: (?<userAgent>%{GREEDYDATA}), sessionId%{GREEDYDATA}\Z" 
}

```

You can play around with your data on some grok tester like [https://grokconstructor.appspot.com/do/match](https://Grokconstructor).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2023, 9:14pm UTC](https://discuss.elastic.co/t/regex-pattern-to-fetch-field-from-message/320563/3 "2023-01-17T21:14:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.