# Separate part of log in Logstash

**URL:** <https://discuss.elastic.co/t/separate-part-of-log-in-logstash/52064>\
**Category:** Logstash\
**Created:** [June 7, 2016, 11:54am UTC](https://discuss.elastic.co/t/separate-part-of-log-in-logstash/52064 "2016-06-07T11:54:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Newman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_newman/32/10207_2.png) [@John\_Newman](https://discuss.elastic.co/u/John_Newman)\
**Post date:** [June 7, 2016, 11:54am UTC](https://discuss.elastic.co/t/separate-part-of-log-in-logstash/52064/1 "2016-06-07T11:54:54Z")

</div>

Hello,

I have problem with config grok plugin. I'm beginner and I don't know yet how it all works.

This is part of logstash conf:

`filter { grok{ match => { "message" => "%{TIMESTAMP_ISO8601:formattedDate}.* %{GREEDYDATA:tempMessage}"} } date{ match => ["formattedDate", "YYYY-MM-dd HH:mm:ss.SSS","ISO8601"] target=>"@timestamp" } }`  
And I have flat file which has below data "  
`2016-06-01 00:00:09.971 [INFO][sample.info.log][sample.info.log] [SINGLETON_CRUSHED|XXX] Locking...`

My output in LS is:

`} "message": "2016-06-01 00:00:09.971 [INFO][sample.info.log][sample.info.log] [SINGLETON_CRUSHED|XXX] Locking... " "@version": "1", "@timestamp": "2016-05-31T22:01:39.995Z", "path": "C:\\data\\sample.log", "host": "SDPL02864", "formattedDate": "2016-06-01 00:01:39.995", "tempMessage": "SINGLETON_CRUSHED|statusX] Locking..." }`

And I don't know how can i separate this part `SINGLETON_CRUSHED|statusX] Locking...` into two parts like here:

`} "message": "2016-06-01 00:00:09.971 [INFO][sample.info.log][sample.info.log] [SINGLETON_CRUSHED|XXX] Locking... " "@version": "1", "@timestamp": "2016-05-31T22:01:39.995Z", "path": "C:\\data\\sample.log", "host": "SDPL02864", "formattedDate": "2016-06-01 00:01:39.995", "tempMessage": "SINGLETON_CRUSHED" <-------------------------- "tempMessage2": "statusX" <-------------------------- }`

How can do this?

Thanks, in advance

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 7, 2016, 11:32pm UTC](https://discuss.elastic.co/t/separate-part-of-log-in-logstash/52064/2 "2016-06-07T23:32:48Z")

</div>

You need to split the `%{GREEDYDATA:tempMessage}` up.  
Head over to [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) to try a few things out 🙂

---

<div class="post-metadata">

**Author:** ![John\_Newman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_newman/32/10207_2.png) [@John\_Newman](https://discuss.elastic.co/u/John_Newman)\
**Post date:** [June 8, 2016, 10:02am UTC](https://discuss.elastic.co/t/separate-part-of-log-in-logstash/52064/3 "2016-06-08T10:02:41Z")

</div>

Thank for you answer. I will try to do this, but it's problematics for me now 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/separate-part-of-log-in-logstash/52064/4 "2017-07-06T04:54:12Z")

</div>