# Snippet q 2

**URL:** <https://discuss.elastic.co/t/snippet-q-2/141343>\
**Category:** Logstash\
**Created:** [July 24, 2018, 9:51am UTC](https://discuss.elastic.co/t/snippet-q-2/141343 "2018-07-24T09:51:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 9:51am UTC](https://discuss.elastic.co/t/snippet-q-2/141343/1 "2018-07-24T09:51:51Z")

</div>

input log file :  
Sep 9 07:50:43 es-rclarke dhclient: bound to 10.10.10.89 -- renewal in 426936 seconds.  
config file is as follows:

filter {  
grok {  
match =\> {  
"message" =\> "%{SYSLOGLINE}"  
}  
overwrite =\> ["message"]  
}  
grok {  
match =\> {  
"message" =\> "bound to %{IPV4:[dhclient][address]} -- renewal in %{INT:[dhclient][renewal]:int} seconds."  
}  
tag\_on\_failure =\> []  
}  
}

In the above two grok patterns especially-SYSLOGLINE stands for?  
likewise why the field names are in two square brackets like [dhcclient][address] and [dhclient][renewal]

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 24, 2018, 6:35pm UTC](https://discuss.elastic.co/t/snippet-q-2/141343/2 "2018-07-24T18:35:28Z")

</div>

> In the above two grok patterns especially-SYSLOGLINE stands for?

You were given the URL to the grok pattern definitions in one of the other threads you started.

> likewise why the field names are in two square brackets like [dhcclient][address] and [dhclient][renewal]

That's the syntax for nested fields, see [Accessing event data and fields | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html).

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 31, 2018, 11:35am UTC](https://discuss.elastic.co/t/snippet-q-2/141343/3 "2018-07-31T11:35:41Z")

</div>

got it. thanks magnus.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2018, 11:35am UTC](https://discuss.elastic.co/t/snippet-q-2/141343/4 "2018-08-28T11:35:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.