# Split output of fping properly with grok **URL:** \ **Category:** Logstash\ **Created:** [March 14, 2020, 3:36pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621 "2020-03-14T15:36:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![hitman22](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@hitman22](https://discuss.elastic.co/u/hitman22)\ **Post date:** [March 14, 2020, 3:36pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621/1 "2020-03-14T15:36:10Z")
Hello, I am trying to Split a Output from fping with grok, but I am not sure how to do it properly. I have the following output from fping [google.de](http://google.de) : xmt/rcv/%loss = 16/16/0%, min/avg/max = 23.6/24.3/25.2 I only need the value of the Hostname in this case [google.de](http://google.de), loss, min, avg and max and the values of them. I only got now the Hostname with the following grok pattern "%{IPORHOST:target\_host}" but I don't how to split it properly for the ozher values, or is this not possible with this output? Maybe someone can give me a hint or help me with this, how to this properly. If this isn't the correct forum, please move the topic. Thank you. Regards hitman22 ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [March 16, 2020, 2:47pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621/2 "2020-03-16T14:47:07Z")
Hello there, what you want to do does not sound difficult (if I got it right) but can you please post here ( **properly spaced and formatted** ) the output of the following pipeline first? ``` input { whatever your input is } filter {} output { stdout{} } ``` I'd like to see what your logs look like to logstash. Thanks ---
**Author:** ![hitman22](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@hitman22](https://discuss.elastic.co/u/hitman22)\ **Post date:** [March 16, 2020, 4:21pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621/3 "2020-03-16T16:21:47Z")
Hello, thanks for your response, this is what I get as Output from Logstash: ``` { "command" => "/usr/sbin/fping -q -c 2 -B1 -r1 < /etc/logstash/fping.conf 2>&1", "tags" => [ [0] "fping" ], "@version" => "1", "type" => "fping", "message" => "8.8.8.8 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 23.9/24.5/25.1\n8.8.4.4 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 25.8/26.0/26.1\n", "@timestamp" => 2020-03-16T16:15:05.163Z, "host" => "VILELK001" } ``` This is what my config looks like for Logstash: ``` input { exec { command => "/usr/sbin/fping -q -c 2 -B1 -r1 < /etc/logstash/fping.conf 2>&1" interval => 10 type => "fping" tags => ["fping"] } } filter {} output { stdout{} } ``` In this example I used to ping 8.8.8.8 and 8.8.4.4 because in the future I want to ping more hosts. With these two IP Adresses, is just for test now. Thanks for your help. ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [March 16, 2020, 6:27pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621/4 "2020-03-16T18:27:59Z")
Ok so, if that's yout input, you can easily extract what you want with the following grok filter: ``` filter { grok { match => { "message" => "%{IPORHOST:test}.*loss = %{DATA}\/%{DATA}\/%{NUMBER:loss}.*= %{NUMBER:min}\/%{NUMBER:avg}\/%{NUMBER:max}" } } } ``` NOTE: if you want the percentage symbol after loss, replace `%{NUMBER:loss}.*` with `%{DATA:loss},.*` (watch the comma after the closing curly bracket). Obviously, you need to find a way to split your input in order to have logstash process multiple events. If you don't find a way to do that and you find yourself with a single big line of logs, you can alway use a Ruby filter to split it over the `\n` character, assign the result to an array field and then use the `split` filter over it and finally apply the grok to the single event. Something like the following: ``` input { generator { count => 1 lines => ['8.8.8.8 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 23.9/24.5/25.1\n8.8.4.4 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 25.8/26.0/26.1\n'] } } filter { ruby { code => " message = event.get('message') events = message.split('\n') event.set('events', events) " } split { field => "events" } grok { match => { "events" => "%{IPORHOST:test}.*loss = %{DATA}\/%{DATA}\/%{NUMBER:loss}%{DATA}= %{NUMBER:min}\/%{NUMBER:avg}\/%{NUMBER:max}" } } mutate { remove_field => ["message"] } mutate { rename => ["events", "message"] } } output { stdout{} } ``` which outputs this: ``` { "avg" => "24.5", "sequence" => 0, "loss" => "0", "min" => "23.9", "@timestamp" => 2020-03-16T18:25:47.240Z, "max" => "25.1", "@version" => "1", "test" => "8.8.8.8", "message" => "8.8.8.8 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 23.9/24.5/25.1", "host" => "fabio" } { "avg" => "26.0", "sequence" => 0, "loss" => "0", "min" => "25.8", "@timestamp" => 2020-03-16T18:25:47.240Z, "max" => "26.1", "@version" => "1", "test" => "8.8.4.4", "message" => "8.8.4.4 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 25.8/26.0/26.1", "host" => "fabio" } ``` _NOTE: the input generator is simply to simulate your input (according to what you posted)_ ---
**Author:** ![hitman22](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@hitman22](https://discuss.elastic.co/u/hitman22)\ **Post date:** [March 16, 2020, 7:17pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621/5 "2020-03-16T19:17:00Z")
Thanks for your help. I have tested it now and when I change my Config to: ``` input { exec { command => "/usr/sbin/fping -q -c 2 -B1 -r1 < /etc/logstash/fping.conf 2>&1" interval => 10 type => "fping" tags => ["fping"] } } filter { ruby { code => " message = event.get('message') events = message.split('\n') event.set('events', events) " } split { field => "events" } grok { match => { "events" => "%{IPORHOST:test}.*loss = %{DATA}\/%{DATA}\/%{NUMBER:loss}%{DATA}= %{NUMBER:min}\/%{NUMBER:avg}\/%{NUMBER:max}" } } mutate { remove_field => ["message"] } mutate { rename => ["events", "message"] } } output { stdout{} } ``` then I still get this Output for the first host, but not for the second one. ``` { "tags" => [ [0] "fping" ], "avg" => "97.8", "max" => "114", "min" => "81.0", "command" => "/usr/sbin/fping -q -c 2 -B1 -r1 < /etc/logstash/fping.conf 2>&1", "message" => "8.8.8.8 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 81.4/97.0/112\n8.8.4.4 : xmt/rcv/%loss = 2/2/0%, min/avg/max = 81.0/97.8/114\n", "@version" => "1", "host" => "VILELK001", "test" => "8.8.8.8", "loss" => "0", "@timestamp" => 2020-03-16T19:10:10.098Z, "type" => "fping" } ``` When I do it in the Input Generator, then the Output looks like your one. Or is there another Error which I have made? I still have to learn grok and so on, because I am new to this and try to understand how this work. Edit: I got it now to work with this: events = message.split(/\n/) Thanks. ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [March 16, 2020, 8:02pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621/6 "2020-03-16T20:02:46Z")
Yeah sure, your character was a real newline, that's why the regex works, silly me. Anyway, the important thing is that the problem is solved. Mark something as a solution so future readers will see the thread has been solved. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2020, 8:12pm UTC](https://discuss.elastic.co/t/split-output-of-fping-properly-with-grok/223621/7 "2020-04-13T20:12:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.