# Spliting log message **URL:** https://discuss.elastic.co/t/spliting-log-message/118181 **Category:** Logstash **Created:** [February 2, 2018, 8:17am UTC](https://discuss.elastic.co/t/spliting-log-message/118181 "2018-02-02T08:17:13Z") **Posts on this page:** 3 **Page:** 1
### Author: ![rkshprb](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@rkshprb](https://discuss.elastic.co/u/rkshprb) #### Post date: [February 2, 2018, 8:17am UTC](https://discuss.elastic.co/t/spliting-log-message/118181/1 "2018-02-02T08:17:13Z")
I have generated logs in HPUX and shipped it to my elk server but logstash is reading those complete logs as one string. I want to split the GREEDYDATA field to generate specific fields. Is their any option in grok or any other way to do so? Is their anything like awk or substrings in grok? ![47](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f27ab3a8dce575319cce0df33914f03c4e6b794.jpg) Kindly refer the above screenshot. We want to separate the timestamp, hostname, message and the value fields. ---
### Author: ![shubham\_kumar1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_kumar1/32/22084_2.png) [@shubham\_kumar1](https://discuss.elastic.co/u/shubham_kumar1) #### Post date: [February 2, 2018, 9:59am UTC](https://discuss.elastic.co/t/spliting-log-message/118181/2 "2018-02-02T09:59:49Z")
message field will always contain the whole log that you have generated. you can extract info from that whole message to generate separate filed in the logstash. Refer [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) for patterns generation. ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [March 2, 2018, 10:00am UTC](https://discuss.elastic.co/t/spliting-log-message/118181/3 "2018-03-02T10:00:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.