# Unable to parse substring of a message in logstash

**URL:** <https://discuss.elastic.co/t/unable-to-parse-substring-of-a-message-in-logstash/99149>\
**Category:** Logstash\
**Created:** [September 1, 2017, 3:47pm UTC](https://discuss.elastic.co/t/unable-to-parse-substring-of-a-message-in-logstash/99149 "2017-09-01T15:47:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pola](https://avatars.discourse-cdn.com/v4/letter/p/919ad9/32.png) [@Pola](https://discuss.elastic.co/u/Pola)\
**Post date:** [September 1, 2017, 3:47pm UTC](https://discuss.elastic.co/t/unable-to-parse-substring-of-a-message-in-logstash/99149/1 "2017-09-01T15:47:21Z")

</div>

Hi,  
I am kind of new to ELK. I have trouble in splitting up substring of a message into fields and my goal is to get active alarms from each host that would be (no. of alarms set - no of alarms cleared).  
message field in kibana shows as :  
{  
"IP":22.33.44.55  
"message": "\<188\>Sep 1 15:16:46.000 22.33.44.55 typed[1369]: Alarm set: License color=YELLOW, class=XYZ, reason=usage requires a license\n"  
}  
{  
"IP":22.33.44.55  
"message": "\<188\>Sep 1 15:29:04.000 22.33.44.55 typed[1350]: Alarm cleared: License color=YELLOW, class=XYZ, reason= usage requires a license\n"  
}

**/etc/logstash/conf.d/syslog.conf** :

```
if [message] =~ "Alarm set" {
  mutate {
    add_field => {
      "alarm" => "set"
    }
  }
  mutate {
    add_field => {
      "alarmcount" => 1
    }
    convert => { "alarmcount" => "integer" }
  }
}

if [message] =~ "Alarm cleared" {
  mutate {
    add_field => {
      "alarm" => "cleared"
    }
  }
  mutate {
    add_field => {
      "alarmcount" => -1
    }
    convert => { "alarmcount" => "integer" }
  }
}
kv {
  source => "message"
  field_split => ","
  value_split => "="
  trim_key => " \t"
  include_keys => ["color", "class", "reason"]
  trim_value => ",\t"
}

```

}

Now that it shows in kibana as :  
"alarm": "cleared",  
"class": "XYZ"  
"reason":"usage requires a license"  
but i don't see color field. Can someone help me with this?

My end goal is to see these fields with respect to the IP and when i visualize it should show no. of active alarms which in this case is 0 as one alarm is set and cleared for same ip(so 0 alarms for ip :22.33.44.55) :

"alarm": "cleared/set",  
"class": "XYZ",  
"color": "YELLOW"  
"reason":"usage requires a license"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2017, 3:47pm UTC](https://discuss.elastic.co/t/unable-to-parse-substring-of-a-message-in-logstash/99149/2 "2017-09-29T15:47:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.