# \[solved\] Namespacing grok output

**URL:** <https://discuss.elastic.co/t/solved-namespacing-grok-output/130448>\
**Category:** Logstash\
**Created:** [May 3, 2018, 11:55am UTC](https://discuss.elastic.co/t/solved-namespacing-grok-output/130448 "2018-05-03T11:55:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sushimaster](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@Sushimaster](https://discuss.elastic.co/u/Sushimaster)\
**Post date:** [May 3, 2018, 11:55am UTC](https://discuss.elastic.co/t/solved-namespacing-grok-output/130448/1 "2018-05-03T11:55:26Z")

</div>

Hi,

when using logstash for pushing apache logs into elasticsearch, very close to the example config in logstash docs:

```
filter {
    mutate {
        replace => { type => "apache_access" }
    }
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    date {
      match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
    }
 useragent {
    source => "agent"
    target => "useragent"
}
}

```

Now, in elasticsearch the results are keys like "request", "host", "auth" etc.

How to namespacing the output, e.g. like the pipeline naming?  
mypipelinename.request  
mypipelinename.host  
mypipelinename.auth  
.... you got the idea.

It would be as more handy and useful as now, don't you think so? Couldn't find anythin in docs yet ☹

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 3, 2018, 12:53pm UTC](https://discuss.elastic.co/t/solved-namespacing-grok-output/130448/2 "2018-05-03T12:53:28Z")

</div>

Two options:

- Copy the definition of COMBINEDAPACHELOG and capture the fields into the desired hierarchy, i.e. change all occurences of `%{SOMEPATTERN:somefield}` to `%{SOMEPATTERN:[mypipelinename][somefield]}`.
- Keep using the original grok pattern but move the fields with a mutate filter afterwards, although then you obviously need to maintain the list of all fields.

---

<div class="post-metadata">

**Author:** ![Sushimaster](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@Sushimaster](https://discuss.elastic.co/u/Sushimaster)\
**Post date:** [May 7, 2018, 9:54pm UTC](https://discuss.elastic.co/t/solved-namespacing-grok-output/130448/3 "2018-05-07T21:54:45Z")

</div>

Thanks, `%{SOMEPATTERN:[mypipelinename][somefield]}` did the job!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2018, 10:06pm UTC](https://discuss.elastic.co/t/solved-namespacing-grok-output/130448/4 "2018-06-04T22:06:13Z")

</div>

Closed on June 4, 2018, 10:06pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.