# Split grok pattern

**URL:** <https://discuss.elastic.co/t/split-grok-pattern/26535>\
**Category:** Logstash\
**Created:** [July 30, 2015, 12:33am UTC](https://discuss.elastic.co/t/split-grok-pattern/26535 "2015-07-30T00:33:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nzbloto22](https://avatars.discourse-cdn.com/v4/letter/n/9dc877/32.png) [@nzbloto22](https://discuss.elastic.co/u/nzbloto22)\
**Post date:** [July 30, 2015, 12:33am UTC](https://discuss.elastic.co/t/split-grok-pattern/26535/1 "2015-07-30T00:33:49Z")

</div>

Hey,

I have just recently started using logstash and am still getting my head around it.  
Is it possible to run a grok filter to match a pattern then split it into two fields or get other values out of it?

For example I have been testing my patterns on: [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)  
If i use the debugger to match say [http://www.google.com](http://www.google.com) to %{URI:test}  
Is it possible to also get the HOSTNAME out of URI?  
URI \> URIHOST \> HOSTNAME  
URI %{URIPROTO}://(?:%{USER}(?::[^@]\*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?

On the debugger I get the output.

{  
"test": [  
[  
"[http://google.com](http://google.com)"  
]  
],  
"URIPROTO": [  
[  
"http"  
]  
],  
"USER": [  
[  
null  
]  
],  
"USERNAME": [  
[  
null  
]  
],  
"URIHOST": [  
[  
"[google.com](http://google.com)"  
]  
],  
"IPORHOST": [  
[  
"[google.com](http://google.com)"  
]  
],  
"HOSTNAME": [  
[  
"[google.com](http://google.com)"  
]  
],  
"IP": [  
[  
null  
]  
],  
"IPV6": [  
[  
null  
]  
],  
"IPV4": [  
[  
null  
]  
],  
"port": [  
[  
null  
]  
],  
"URIPATHPARAM": [  
[  
null  
]  
],  
"URIPATH": [  
[  
null  
]  
],  
"URIPARAM": [  
[  
null  
]  
]  
}

I'm interested in my field "test" but also would like the field HOSTNAME out of it. Obviously the value is there but I'm not sure how to get it as a field into elasticsearch.

---

<div class="post-metadata">

**Author:** ![pemontto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pemontto/32/3908_2.png) [@pemontto](https://discuss.elastic.co/u/pemontto)\
**Post date:** [July 30, 2015, 3:31am UTC](https://discuss.elastic.co/t/split-grok-pattern/26535/2 "2015-07-30T03:31:13Z")

</div>

You can create your own pattern based off the existing URI pattern and make it capture those fields e.g.

The original pattern:

```
%{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?

```

Customised pattern:

```
%{URIPROTO:uri_proto}://(?:%{USER:user}(?::[^@]*)?@)?(?:%{URIHOST:uri_host})?(?:%{URIPATHPARAM:uri_param})?

```

This will extract all the fields out like so

```
{
  "uri": [
    "http://www.google.com"
  ],
  "uri_proto": [
    "http"
  ],
  "user": [
    null
  ],
  "uri_host": [
    "www.google.com"
  ],
  "port": [
    null
  ],
  "uri_param": [
    null
  ]
}

```

You can then call this MY\_URI or similar and add it to a custom patterns file, or just use the raw pattern in your config in place of %{URI}. You can also test custom patterns in the debugger by selecting the "Add custom patterns" checkbox.

---

<div class="post-metadata">

**Author:** ![nzbloto22](https://avatars.discourse-cdn.com/v4/letter/n/9dc877/32.png) [@nzbloto22](https://discuss.elastic.co/u/nzbloto22)\
**Post date:** [August 3, 2015, 12:42am UTC](https://discuss.elastic.co/t/split-grok-pattern/26535/3 "2015-08-03T00:42:12Z")

</div>

Thanks for the info.  
After reading through that it actually makes perfect sense to do this. I managed to make my own filter for this and its working well!

Cheers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/split-grok-pattern/26535/4 "2017-07-06T05:33:07Z")

</div>