# Use field value to match custom Grok pattern **URL:** \ **Category:** Logstash\ **Created:** [November 21, 2018, 10:33am UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681 "2018-11-21T10:33:52Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![apluchart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apluchart/32/18684_2.png) [@apluchart](https://discuss.elastic.co/u/apluchart)\ **Post date:** [November 21, 2018, 10:33am UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/1 "2018-11-21T10:33:52Z")
Hi, I'm trying to parse some log (from cisco ironport) and I want to use a field value to access my custom patterns. To be clear there is my actual filter : > dissect { > mapping =\> {"message" =\> "\<%{syslog5424pri}\>%{mois} %{jour} %{heure}:%{minute}:%{seconde} %{log\_type}: %{log\_level}: %{iron\_msg\_type} %{iron\_msg}"} > tag\_on\_failure =\> ["dpf\_global"] > } > grok{ > patterns\_dir =\> ["/my/patterns/dir"] > break\_on\_match =\> true > match =\> {"iron\_msg"=\>"%{iron\_msg\_type}"} > tag\_on\_failure =\> ["\_gpf\_global"] > } But Logstash return me he doesn't know about %{iron\_msg\_type}. So is it really possible to do this ? We it's possible, please help me. ---
**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Post date:** [November 21, 2018, 10:42am UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/2 "2018-11-21T10:42:18Z")
Could you give us some raw input lines please? 3 or 4 would be good! Also can you post your patterns file? ---
**Author:** ![apluchart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apluchart/32/18684_2.png) [@apluchart](https://discuss.elastic.co/u/apluchart)\ **Post date:** [November 21, 2018, 12:17pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/3 "2018-11-21T12:17:39Z")
Data sample > \<142\>Oct 05 05:08:33 Mail\_Logs-syslog: Info: Start MID 100000000 ICID 200000000 > \<142\>Oct 05 05:08:47 Mail\_Logs-syslog: Info: Outbreak Rule: OUTBREAK\_10000000 has threat level 5 > \<142\>Oct 05 05:08:38 Mail\_Logs-syslog: Info: Delivery start DCID 20000000 MID 100000000 to RID [0] Custom Pattern: > Start (MID %{DATA:mid} ICID %{GREEDYDATA:icid}) > Outbreak (%{GREEDYDATA}\_%{DATA:outbreak\_id} %{GREEDYDATA} %{DATA:threat\_level}) > Delivery (start DCID %{DATA:dcid} MID %{DATA:mid} to RID [%{GREEDYDATA:rid}]) ---
**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Post date:** [November 21, 2018, 12:26pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/4 "2018-11-21T12:26:45Z")
Hi, I see you have not defined a %{iron\_msg\_type} field in your pattern? This is probably why the error is occuring. ---
**Author:** ![apluchart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apluchart/32/18684_2.png) [@apluchart](https://discuss.elastic.co/u/apluchart)\ **Post date:** [November 21, 2018, 12:32pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/5 "2018-11-21T12:32:48Z")
No I don't have to define it because I want to use the value of this field (iron\_msg\_type) created in the dissect part to access my custom patterns. ---
**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Post date:** [November 21, 2018, 12:49pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/6 "2018-11-21T12:49:57Z")
No, your syntax is wrong as far as I can see. Your telling it to match "iron\_msg" field to the pattern %{iron\_msg\_type} - you do not have an iron message pattern hence the error. Try this instead: ``` Patterns file: START (MID %{DATA:mid} ICID %{GREEDYDATA:icid}) OUTBREAK (%{GREEDYDATA}_%{DATA:outbreak_id} %{GREEDYDATA} %{DATA:threat_level}) DELIVERY (start DCID %{DATA:dcid} MID %{DATA:mid} to RID [%{GREEDYDATA:rid}]) grok{ patterns_dir => ["/my/patterns/dir"] break_on_match => true match => {"iron_msg" => ["%{START}", "%{OUTBREAK}", "%{DELIVERY}"]} tag_on_failure => ["_gpf_global"] } ``` I've tested this and it works, but your patterns could do with a bit of fine tuning to make it nicer. ---
**Author:** ![apluchart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apluchart/32/18684_2.png) [@apluchart](https://discuss.elastic.co/u/apluchart)\ **Post date:** [November 21, 2018, 1:10pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/7 "2018-11-21T13:10:38Z")
So it's impossible to use a field value to access the exact grok pattern directly? I was thinking it could work like that: Ex with a "Start" log Dissect\_process =\> iron\_msg\_type = "Start", iron\_msg = "blablabla" Then Grok Process =\> match =\> {"iron\_msg"=\>"Start"(the iron\_msg\_type value)} Then go to my Start custom pattern. ---
**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Post date:** [November 21, 2018, 1:16pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/8 "2018-11-21T13:16:06Z")
Sorry I am not quite sure what you mean or what you are hoping to achieve? Maybe if you could explain what fields you want to end up with it would be easier? ---
**Author:** ![apluchart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apluchart/32/18684_2.png) [@apluchart](https://discuss.elastic.co/u/apluchart)\ **Post date:** [November 21, 2018, 1:24pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/9 "2018-11-21T13:24:05Z")
Simply just don't want to specify all my custom patterns names in my grok matching like you did: > match =\> {"iron\_msg" =\> ["%{START}", "%{OUTBREAK}", "%{DELIVERY}"]} But do it like that instead: > match =\> {"iron\_msg"=\>" **the value of the iron\_msg\_type field**"} So when [iron\_msg\_type] == "Start" Grok understand : > match =\> {"iron\_msg"=\>" **Start**"} I'm not sure that is clear... This is my iron\_msg\_type field that define the custom pattern to use. ---
**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\ **Post date:** [November 21, 2018, 1:29pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/10 "2018-11-21T13:29:16Z")
I understand now. To be honest, I don't know, I've never tried to do that. I think it is evaluating it as a pattern rather than the taking it as a literal string. I assume your log file varies so much that you would have to create many different patterns? ---
**Author:** ![apluchart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/apluchart/32/18684_2.png) [@apluchart](https://discuss.elastic.co/u/apluchart)\ **Post date:** [November 21, 2018, 1:33pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/11 "2018-11-21T13:33:07Z")
Exactly ! I think It would be more efficient in my way but I think you're right about this so I close this topic. Thanks a lot ! Have a nice day. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 19, 2018, 1:33pm UTC](https://discuss.elastic.co/t/use-field-value-to-match-custom-grok-pattern/157681/12 "2018-12-19T13:33:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.