# Regex to break from specific word or character in a log line

**URL:** <https://discuss.elastic.co/t/regex-to-break-from-specific-word-or-character-in-a-log-line/101840>\
**Category:** Logstash\
**Created:** [September 26, 2017, 12:03pm UTC](https://discuss.elastic.co/t/regex-to-break-from-specific-word-or-character-in-a-log-line/101840 "2017-09-26T12:03:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)\
**Post date:** [September 26, 2017, 12:03pm UTC](https://discuss.elastic.co/t/regex-to-break-from-specific-word-or-character-in-a-log-line/101840/1 "2017-09-26T12:03:33Z")

</div>

I want to split below log line

"APP-DETECT TeamViewer remote administration tool outbound connection attempt" [Impact: Potentially Vulnerable] From ABC

As like

name : APP-DETECT TeamViewer remote administration tool outbound connection attempt  
impact : Potentially Vulnerable  
other : From ABC

How can I create a grok or regex to break sentence as above scenario.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [September 26, 2017, 1:43pm UTC](https://discuss.elastic.co/t/regex-to-break-from-specific-word-or-character-in-a-log-line/101840/2 "2017-09-26T13:43:33Z")

</div>

I presume LS 5.x or greater.

You can use the dissect filter for this, provided that:

1. The first section is always in double quotes.
2. The second section is always in square brackets.
3. The term "Impact" is always the same and in the same place (let me know if a different term is in that place and you want the field to be named that, dissect has a solution for that)

If so then read on.

```auto
filter {
  dissect {
    mapping => { "message" => '"%{name}" [Impact: %{impact}] %{other}' }
  }
}

```

If some lines are not like this then use an `if block` to only apply dissect conditionally.

```auto
filter {
  if [message] =~ "^\"APP-DETECT.+\[Impact:.+\]"
    dissect {
      mapping => { "message" => '"%{name}" [Impact: %{impact}] %{other}' }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2017, 1:43pm UTC](https://discuss.elastic.co/t/regex-to-break-from-specific-word-or-character-in-a-log-line/101840/3 "2017-10-24T13:43:46Z")

</div>

Closed on October 24, 2017, 1:43pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.