# Using grok instead of csv filter

**URL:** <https://discuss.elastic.co/t/using-grok-instead-of-csv-filter/75540>\
**Category:** Logstash\
**Created:** [February 17, 2017, 5:38pm UTC](https://discuss.elastic.co/t/using-grok-instead-of-csv-filter/75540 "2017-02-17T17:38:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![abd.wsu](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abd.wsu](https://discuss.elastic.co/u/abd.wsu)\
**Post date:** [February 17, 2017, 5:38pm UTC](https://discuss.elastic.co/t/using-grok-instead-of-csv-filter/75540/1 "2017-02-17T17:38:47Z")

</div>

I have a csv files with multiple lines as follows

`"Archive","Major Interval","DEV1","f328c29c-c695-11e5-addb-cc355a180000","EG1","5d56048e-5201-0000-0080-b2bb5fd9a209","TestHeartBeatFlow","3e452a8e-5201-0000-0080-a896a7ab9b4c","","","","","2017-02-17","02:46:1.054058","2017-02-17 08:46:1.05405","2017-02-17","03:46:2.572417","2017-02-17 09:46:2.57241","6637497","767","11845","333","4576041","529","2566","302","1133995","3594619278","8646","7774713","899","976","762","1","8646","0","0","0","0","0","0","Anonymous"`

I am using the csv filter and mutate the get the outputs as following

`"input_messages":"8646","eg_name":"EG1","broker_name":"DEV1","@timestamp":"2017-02-17T09:46:02.534Z","flowname":"TestHeartBeatFlow","cputime":"4576041"`

I was just curious how i can get the same result with grok, if at all that is possible.

I tried using

```
filter{
grok{
match => { "message" => "%{WORD:type} %{WORD:interval} %{WORD:broker} %{....

```

But stopped completing since there are so many unwanted fields. Is there an easier way of doing this with grok?

---

<div class="post-metadata">

**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Post date:** [February 18, 2017, 7:22am UTC](https://discuss.elastic.co/t/using-grok-instead-of-csv-filter/75540/2 "2017-02-18T07:22:41Z")

</div>

Clearly, csv filter is much more relevant for your use case.  
With grok , you would have a very long pattern, which would be a lot less generic and simple.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2017, 7:23am UTC](https://discuss.elastic.co/t/using-grok-instead-of-csv-filter/75540/3 "2017-03-18T07:23:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.