title: (Logstash, Grok) if field contains a specific word, then save some characters from it
body: <p>I have following filter which achieves most of my needs:</p>
  
  filter {
  
  <pre><code>grok {
      match =&gt; { "message" =&gt; [ "%{IPORHOST:clientip} - %{NGUSER:user} \[%{HTTPDATE:timestamp}\] (?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest}) %{NUMBER:response} (?:%{NUMBER:bytes}|-) (-|(%{DATA:referrer})) ] }
  </code></pre>
  
  <p>However, some (not all) logs I am parsing in contain the name of the channel a user is using on my Apache server.</p>
  
  <p>A normal log including the word "channel" would be like this:</p>
  
  <hr>
  
  <p>10.40.80.11 - alex@example.com [03/Jan/2014:13:08:21 +0000] "GET /cgi-bin/feed/epg?channel=Bloomberg%20English&amp;date=2016-01-03 HTTP/1.1" 200 368 "<a href="http://example.net/cgi-bin/feed/epg" rel="nofollow">http://example.net/cgi-bin/feed/epg</a>" "Mozilla/5.0"</p>
  
  <hr>
  
  <p>The field "rawrequest" is saved on a separate field like this: </p>
  
  <p>"GET /cgi-bin/feed/epg?channel=Bloomberg%20English&amp;date=2016-04-04 HTTP/1.1"</p>
  
  <p>Question:
  How can I save the names of the channels on a separate field considering not all logs contain the word channel in the field "rawrequest"?.</p>
  
  <p>I have seen lots of examples but nothing similar.The character separating the channel to the rest of the string is "&amp;".
  I would appreciate any help. </p>
  
  <p>Solution:</p>
  
  <pre><code>match =&gt; { "request" =&gt; [ "channel=(?&lt;Channels&gt;[^&amp;]+)" ] }
  </code></pre>