# Retrieve Fields from the String

**URL:** <https://discuss.elastic.co/t/retrieve-fields-from-the-string/231450>\
**Category:** Logstash\
**Created:** [May 7, 2020, 4:23am UTC](https://discuss.elastic.co/t/retrieve-fields-from-the-string/231450 "2020-05-07T04:23:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![karthik3](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@karthik3](https://discuss.elastic.co/u/karthik3)\
**Post date:** [May 7, 2020, 4:23am UTC](https://discuss.elastic.co/t/retrieve-fields-from-the-string/231450/1 "2020-05-07T04:23:35Z")

</div>

Hi,

How we can get the value from the string in logstash.

Sample Log:  
2020-04-27 00:44:30,445 INFO START [[Thread1]]logger - {  
"sourcetype":"MachineA",  
"event":{"timestamp":"2020-04-29T00:00:00.000","logLevel": "Debug","TransactionId": "12345",  
"content":{  
"payload":"{"Date": "28.04.2020","Name": "KARTHIK","Origin":"MAA","Destination":"FRK","AirlineBooking":"Yes"}"  
}  
}  
}

How to get the value of AirlineBooking, Origin,Destination,date,name from the payload?

My Filter:

filter  
{  
if "START [[" in [message]  
{  
grok  
{  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:logtime} %{LOGLEVEL:loglevel} %{DATA:audittype} %{DATA:app} - %{GREEDYDATA:jsondata}" }  
}  
json { source =\> "jsondata" }  
mutate { add\_field =\> { "RequestTimeStamp" =\> "%{[event][timestamp]}"  
"LogLevel" =\> "%{[event][logLevel]}" } }

Regards,  
Karthikeyan S

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 7, 2020, 5:32am UTC](https://discuss.elastic.co/t/retrieve-fields-from-the-string/231450/2 "2020-05-07T05:32:22Z")

</div>

you can pass the payload field to another json filter

---

<div class="post-metadata">

**Author:** ![karthik3](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@karthik3](https://discuss.elastic.co/u/karthik3)\
**Post date:** [May 14, 2020, 1:36pm UTC](https://discuss.elastic.co/t/retrieve-fields-from-the-string/231450/3 "2020-05-14T13:36:39Z")

</div>

Thanks for the response. Its working now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2020, 1:46pm UTC](https://discuss.elastic.co/t/retrieve-fields-from-the-string/231450/4 "2020-06-11T13:46:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.