# Splitting greedydata
**URL:** https://discuss.elastic.co/t/splitting-greedydata/78408
**Category:** Logstash
**Created:** [March 13, 2017, 7:44pm UTC](https://discuss.elastic.co/t/splitting-greedydata/78408 "2017-03-13T19:44:07Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Alex\_Mendez](https://discuss.elastic.co/u/Alex_Mendez)
#### Post date: [March 13, 2017, 7:44pm UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/1 "2017-03-13T19:44:07Z")
Greetings, I'd like to know if its possible to split the message in GREEDYDATA further into searchable data.
Example
line in log stash
grok {
match =\> ["message", "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME} %{PROG:program}(?:[%{POSINT:pid}])? %{GREEDYDATA:msgsplit}"]
logstash output
logstash[17194]: "msgsplit" =\> " Did not receive identification string from ",
logstash[17194]: "msgsplit" =\> " pam\_unix(sshd:session): session opened for user tester by (uid=0)",
Can i take GREEDYDATA,"msgsplit" and further break that down? If so , any guidance on the best way to approach this?
---
### Author:  [@rayl7786](https://discuss.elastic.co/u/rayl7786)
#### Post date: [March 13, 2017, 8:36pm UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/2 "2017-03-13T20:36:56Z")
I did something similar,
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:date} %{IPORHOST:hostname} %{GREEDYDATA:msg}" }
}
mutate {
replace =\> ["message", "%{msg}"]
}
mutate {
remove\_field =\> ["msg"]
}
grok {
match =\> { "message" =\> "" }
}
Not sure if this is what you are looking for.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 14, 2017, 6:25am UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/3 "2017-03-14T06:25:42Z")
> grok {
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:date} %{IPORHOST:hostname} %{GREEDYDATA:msg}" }
> }
> mutate {
> replace =\> ["message", "%{msg}"]
> }
> mutate {
> remove\_field =\> ["msg"]
> }
Shorter:
```plaintext
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:date} %{IPORHOST:hostname} %{GREEDYDATA:msg}" }
overwrite => ["message"]
}
```
> grok {
> match =\> { "message" =\> "" }
> }
What's this supposed to mean?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 14, 2017, 6:27am UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/4 "2017-03-14T06:27:10Z")
> Can i take GREEDYDATA,"msgsplit" and further break that down? If so , any guidance on the best way to approach this?
You can apply another grok filter to your `msgsplit` field. Or, don't use GREEDYDATA in the first place; just use a more specific pattern.
---
### Author:  [@rayl7786](https://discuss.elastic.co/u/rayl7786)
#### Post date: [March 14, 2017, 12:17pm UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/5 "2017-03-14T12:17:16Z")
Sorry, I should have stated something in between the "". I just left it blank to show what I did. Thank you for the shorter way. I will implement this in my filters.
In yours, the 'overwrite =\> ["message"]' should show the field name you used for Greedydata, correct?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 14, 2017, 12:30pm UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/6 "2017-03-14T12:30:14Z")
> In yours, the 'overwrite =\> ["message"]' should show the field name you used for Greedydata, correct?
Yes.
---
### Author:  [@Alex\_Mendez](https://discuss.elastic.co/u/Alex_Mendez)
#### Post date: [April 5, 2017, 6:18pm UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/7 "2017-04-05T18:18:28Z")
thanks i ended up creating a more specific pattern
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 3, 2017, 6:18pm UTC](https://discuss.elastic.co/t/splitting-greedydata/78408/8 "2017-05-03T18:18:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.