title: Custom GROK filter - Logstash -> Elasticsearch
body: <p>I have a log which is getting captured and sent to logstash, the format of the log is</p>
  
  <pre><code>22304999    5   400.OUTPUT_SERVICE.510  submit  The limit has been exceeded. Please use a different option. 2.54.44.221 /api/output/v3/contract/:PCID/order /api/output/v3/contract/:pcid/order https://www.example.org/output/ PUT 400 2017-09-28T15:50:57.843176Z
  </code></pre>
  
  <p>I am trying to create a custom grok filter to add the header fields before it gets sent to elasticsearch.</p>
  
  <p>My aim is something like this,</p>
  
  <pre><code> SessionID   =&gt; "22304999"
   HitNumber   =&gt; "5"
   FactValue   =&gt; "400.OUTPUT_SERVICE.510"
   DimValue1   =&gt; "submit"
   ErrMessage  =&gt; "The limit has been exceeded. Please use a different option."
   IP          =&gt; "2.54.44.221"
   TLT_URL     =&gt; "/api/output/v3/contract/:PCID/order"
   URL         =&gt; "/api/output/v3/contract/:pcid/order"
   Refferer    =&gt; "https://www.example.org/output/"
   Method      =&gt; "PUT"
   StatsCode   =&gt; "400"
   ReqTime     =&gt; "2017-09-28T15:50:57.843176Z"
  </code></pre>
  
  <p>I am new to this so only trying to understand how I apply and test this, for example I would start with an empty filter,</p>
  
  <pre><code>filter {
     grok {
       match =&gt; { "message" =&gt; "" }
     }
   }
  </code></pre>
  
  <p>My first question is <code>match =&gt; { "message" =&gt; "" }</code> is message just a log line? What defines 'message'?</p>
  
  <p>My log and the fields I want are separated by a Tab, after each Tab its a new field, would this make what I am trying to achieve easier, rather than looking for a pattern can I just look for the next Tab?</p>
  
  <p>Failing this, could someone provide an example for one of my fields, from that I should be able to complete the rest.</p>