# Trying to separate fields from logs using GROK **URL:** \ **Category:** Logstash\ **Created:** [December 19, 2017, 8:31am UTC](https://discuss.elastic.co/t/trying-to-separate-fields-from-logs-using-grok/112375 "2017-12-19T08:31:28Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Vivek\_Samaga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_samaga/32/43285_2.png) [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Post date:** [December 19, 2017, 8:31am UTC](https://discuss.elastic.co/t/trying-to-separate-fields-from-logs-using-grok/112375/1 "2017-12-19T08:31:28Z")
Hi am trying to separate fields from the log message below. `127.0.0.1 - - [25/Sep/2017:06:13:23 -0500] 4 "GET /CacheManager/HCD_CLIENTS/BN_HS HTTP/1.1" 200 118 ***:9090 "-" "-"` I have been trying to parse / separate the numeric `4` which is microsecond for average response time but doesn't seem to work below is the GROK filter i tried. `%{IPORHOST:clientip} %{USER:ident} %{USER:ident} \[%{HTTPDATE:timestamp}\] %{NOTSPACE:request} "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 19, 2017, 8:49am UTC](https://discuss.elastic.co/t/trying-to-separate-fields-from-logs-using-grok/112375/2 "2017-12-19T08:49:58Z")
Build your expression gradually. Start with the simplest possible, like `%{IPORHOST:clientip}` and add more and more until your done or until something breaks. ---
**Author:** ![TheExploringDev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theexploringdev/32/19550_2.png) [@TheExploringDev](https://discuss.elastic.co/u/TheExploringDev)\ **Post date:** [December 19, 2017, 11:40am UTC](https://discuss.elastic.co/t/trying-to-separate-fields-from-logs-using-grok/112375/3 "2017-12-19T11:40:59Z")
> [@Vivek\_Samaga](#): > > I have been trying to parse / separate the numeric 4 which is microsecond for average response time but doesn't seem to work below is the GROK filter i tried. As @magnusbaeck pointed out, Build your expression gradually, I will recommend using GROK FILTER %{NUMBER} to read the numerics. This should work 😀 %{IPORHOST:clientip} %{USER:ident} %{USER:ident} [%{HTTPDATE:timestamp}] %{NUMBER:responsetime} "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) ---
**Author:** ![Vivek\_Samaga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_samaga/32/43285_2.png) [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Post date:** [December 20, 2017, 10:08am UTC](https://discuss.elastic.co/t/trying-to-separate-fields-from-logs-using-grok/112375/4 "2017-12-20T10:08:12Z")
Ya thanks, I have it now but my problem is when I apply this in logstash.conf file inside filter section the logs aren't appearing. It just stops. This works fine while debugging in GROK debugger. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 20, 2017, 10:34am UTC](https://discuss.elastic.co/t/trying-to-separate-fields-from-logs-using-grok/112375/5 "2017-12-20T10:34:25Z")
Have you looked for clues in the Logstash log? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2018, 10:35am UTC](https://discuss.elastic.co/t/trying-to-separate-fields-from-logs-using-grok/112375/6 "2018-01-17T10:35:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.