# Salt - Grok

**URL:** <https://discuss.elastic.co/t/salt-grok/61864>\
**Category:** Logstash\
**Created:** [September 29, 2016, 8:35pm UTC](https://discuss.elastic.co/t/salt-grok/61864 "2016-09-29T20:35:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![idokaplan](https://avatars.discourse-cdn.com/v4/letter/i/e36b37/32.png) [@idokaplan](https://discuss.elastic.co/u/idokaplan)\
**Post date:** [September 29, 2016, 8:35pm UTC](https://discuss.elastic.co/t/salt-grok/61864/1 "2016-09-29T20:35:59Z")

</div>

Hi,

```
'pkg_|-wget_|-wget_|-installed': {
  'comment': u'Package wget is already installed',
  'name': 'wget',
  'start_time': '19:22:47.084891',
  'result': True,
  'duration': u'352.292 ms',
  ' __run_num__': 0,
  'changes': {
    
  },
  ' __id__': 'wget'
},
'service_|-kafka-service_|-kafka-manager_|-running': {
  'comment': u'Service restarted',
  'name': 'kafka-manager',
  'start_time': '19:22:47.676641',
  'result': True,
  'duration': u'4056.619 ms',
  ' __run_num__': 18,
  'changes': {
    'kafka-manager': True
  },
  ' __id__': 'kafka-service'
},

```

Can you please help me to create two events from this output?  
The split should be after ' **id**': '\*'  
},

Thanks!  
Ido

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/salt-grok/61864/2 "2017-07-06T04:36:22Z")

</div>

Closed on July 6, 2017, 4:36am UTC