# Turn messages into fields - querying in kibana **URL:** \ **Category:** Logstash\ **Created:** [March 23, 2016, 4:50pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259 "2016-03-23T16:50:32Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Post date:** [March 23, 2016, 4:50pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/1 "2016-03-23T16:50:32Z")
Hello, I am trying to analyze some access and report logs in kibana..I want to be able to query on the message I receive on kibana...Basically I want to turn the messages onto fields to be able to query on them. How can I do that in kibana? modify the existing log-stash file? The contents of access log looks like the following: access.log 00:42:10,411 INFO [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' access:14 - |peka|searchCustomer|https://32.90.12:253/service/soap/vhandset/CustomerManagement/CustomerLookupService report.log and the report logs like the following: 2016-03-22 00:4110|mayan|searchVendor|2509 The configuration for the above files is the following: logstash-shipper.conf input { file { path =\> ["/path/to/logs/report.log", "/path/to/logs/access.log"] type =\> "syslog" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" ignore\_older =\> 0 } } output { stdout { codec =\> rubydebug } redis { host =\> "13.22.10.141" data\_type =\> "list" key =\> "newlog" } } ---
**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Post date:** [March 23, 2016, 5:44pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/2 "2016-03-23T17:44:01Z")
I tried the following in logstash config file...but I am getting a grokparsefailure... filter { grok { match =\> ["message", "%{COMBINEDAPACHELOG}"] } } ---
**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Post date:** [March 23, 2016, 6:10pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/3 "2016-03-23T18:10:53Z")
I also tried to the following for the log: 2016-03-22 00:4110|mayan|searchVendor|2509 filter { grok { match =\> ["message", "%{DATE:todaysdate} %{SECOND:seconds} %{WORD:Username} %{WORD:Vendorname} % {BASE16NUM:bytes}"] } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 23, 2016, 6:50pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/4 "2016-03-23T18:50:03Z")
> match =\> ["message", "%{DATE:todaysdate} %{SECOND:seconds} %{WORD:Username} %{WORD:Vendorname} % {BASE16NUM:bytes}"] This expression clearly doesn't match the log message. For example, you're ignoring the "|" characters. Perhaps [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) or [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/) can help you build the expression. As a general comment, you probably don't want to assign these files the type "syslog" since I assume they're not syslog messages. Secondly, since the log messages look very differently I suggest you assign different types to them. Use two file inputs instead of one. ---
**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Post date:** [March 23, 2016, 7:18pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/5 "2016-03-23T19:18:26Z")
Hi, Thanks for your reply. How do i take a | character into account? Also, what do you mean when you say to use two file inputs? ---
**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Post date:** [March 23, 2016, 7:37pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/6 "2016-03-23T19:37:56Z")
So I did the following: it's still giving me grokparsewrror: filter { grok { match =\> ["message", "%{DATE:todaysdate} %{SPACE} %{SECOND:seconds} %{NOTSPACE} %{WORD:Username} %{NOTSPACE} %{WORD:Vendorname} %{NOTSPACE} %{BASE16NUM:bytes}"] } } ---
**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Post date:** [March 23, 2016, 8:01pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/7 "2016-03-23T20:01:38Z")
I fixed it! it works! ---
**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Post date:** [March 23, 2016, 8:20pm UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/8 "2016-03-23T20:20:29Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/b/b1afb28cb5ba9a8924686c4a8f7bde2083f2fa18.PNG) Why is there a question mark next to the fields I extracted from the logs shown in Kibana ? Does it indicate it has not been properly extracted? (username, vendorname, bytes, seconds, todaysdate) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/turn-messages-into-fields-querying-in-kibana/45259/9 "2017-07-06T05:05:39Z")