# Transform and simplify long regex with dissect or grok?

**URL:** https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973
**Category:** Logstash
**Created:** [September 13, 2023, 3:21pm UTC](https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973 "2023-09-13T15:21:04Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![sam1975](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 13, 2023, 3:21pm UTC](https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973/1 "2023-09-13T15:21:05Z")

</div>

Hello,  
I have some long and heavy regex and i wonder if i can simplify and gain in term of performances by using dissect  
here are some examples

1. "^\<%{NONNEGINT:syslog\_priority:int}\>1 (?:-|%{TIMESTAMP\_ISO8601:syslog\_timestamp}) (?:-|%{SYSLOGHOST:syslog\_hostname}) (?:%{PROG:syslog\_process}|-) (?:-|%{POSINT:syslog\_uid}) (?:-|%{WORD:syslog\_message\_id}) (?:-|(?\<syslog\_structured\_data\>([.\*?[^\]])+))(?:%{SPACE}%{GREEDYDATA:syslog\_message}|)$

2. "^\<%{NONNEGINT:syslog\_priority:int}\>(1 )?(%{TIMESTAMP\_ISO8601:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname}|%{SYSLOGHOST:syslog\_hostname}: (\d{4} )?%{SYSLOGTIMESTAMP:syslog\_timestamp}) (?\<syslog\_process\>\b[\w.\_/%-]+\b)(?:[%{POSINT:syslog\_uid}])?:?%{SPACE}%{GREEDYDATA:syslog\_message}$",\*

3)"^(\<%{NONNEGINT:syslog\_priority:int}\>)?(\d{4} )?%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} (?\<syslog\_process\>\b[\w.\_/%-]+\b)(?:[%{POSINT:syslog\_uid}])?:?%{SPACE}%{GREEDYDATA:syslog\_message}$",

thank you for your help

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 13, 2023, 3:35pm UTC](https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973/2 "2023-09-13T15:35:32Z")

</div>

Most of the time you can replace your grok with a similar dissect filter, but how they work is completely different.

Grok will validate the data type, dissect is just positional, it will not validate anything, it will parse by the position.

If your logs have always the same structure and the values are always in the same place, then you can use dissect.

Sometimes you can also combine different parsers like grok, dissect, kv, json etc.

Can you share sample messages for your patterns?

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [September 13, 2023, 5:37pm UTC](https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973/3 "2023-09-13T17:37:18Z")

</div>

This looks like the syslog format, which is more suitable grok in case you have optional fields.  
Is this 3 types of grok patterns in the same matching or you have 3 different syslog sources and the grok patterns?

---

<div class="post-metadata">

### Author: ![sam1975](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 14, 2023, 1:48pm UTC](https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973/4 "2023-09-14T13:48:45Z")

</div>

the sources are differents.  
In the pipeline from which these grok come, the output is an index elk.  
I wonder if it would be more logic to use http filter in that case and write directly in the index?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 14, 2023, 2:09pm UTC](https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973/5 "2023-09-14T14:09:35Z")

</div>

> [@sam1975](#):
>
> I wonder if it would be more logic to use http filter in that case and write directly in the index?

Not sure how this would help as you would still need to parse the message.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 12, 2023, 2:10pm UTC](https://discuss.elastic.co/t/transform-and-simplify-long-regex-with-dissect-or-grok/342973/6 "2023-10-12T14:10:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.