# Rsyslog to logstash as json -\> extract pattern from message

**URL:** https://discuss.elastic.co/t/rsyslog-to-logstash-as-json-extract-pattern-from-message/361382
**Category:** Logstash
**Created:** [June 13, 2024, 9:27am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-as-json-extract-pattern-from-message/361382 "2024-06-13T09:27:07Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![vasilev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vasilev/32/81983_2.png) [@vasilev](https://discuss.elastic.co/u/vasilev)
#### Post date: [June 13, 2024, 9:27am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-as-json-extract-pattern-from-message/361382/1 "2024-06-13T09:27:07Z")

</div>

Hello all,

I am sending rsyslog data to logstash via udp. Here is the logstash configuration:

> input {  
> udp {  
> port =\> 15044  
> codec =\> "json"  
> type =\> "rsyslog"  
> }  
> }  
> filter {  
> if [srvtype] == "test" {  
> json {  
> source =\> ""  
> remove\_field =\> ["facility"]  
> }  
> mutate {  
> add\_field =\> {  
> "test" =\> ""  
> }  
> rename =\> {  
> "[message]" =\> "[errormessage]"  
> }  
> }  
> }  
> }

The message is something like:

> text text text (TEXT1.TEXT2) [Thread 489] (Msg 1/1) XYZ2154: text...

the interesting part for me is TEXT1 and XYZ2154.  
is there any way to take these strings and add them in a new field in the mutate ?

thank you

---

<div class="post-metadata">

### Author: ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [June 13, 2024, 11:12am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-as-json-extract-pattern-from-message/361382/2 "2024-06-13T11:12:09Z")

</div>

Hi,

Here's an example of how you might use the `grok` filter to extract the `TEXT1` and `XYZ2154` parts of your message:

```auto
filter {
  if [srvtype] == "test" {
    grok {
      match => { "message" => ".*\(%{WORD:TEXT1}\.%{WORD:TEXT2}\).*%{WORD:code}:.*" }
    }
    mutate {
      remove_field => ["facility"]
      rename => { "message" => "errormessage" }
    }
  }
}

```

Regards

---

<div class="post-metadata">

### Author: ![vasilev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vasilev/32/81983_2.png) [@vasilev](https://discuss.elastic.co/u/vasilev)
#### Post date: [June 13, 2024, 12:02pm UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-as-json-extract-pattern-from-message/361382/3 "2024-06-13T12:02:03Z")

</div>

Thank you for the reply.

is working fine !