title: How to get log message in separated field whih logstash
body: <p>I'm trying to get my log in a specific way in kibana from logstash but I'm not succeedinig.</p>
  
  <p>I will explain by example. Then if I have in my log file this line :</p>
  
  <pre><code>2015-06-17 13:08:45      INFO    connectionpool  Starting new HTTPS connection (1): SSX9FSMULE.algolia.net
  </code></pre>
  
  <p>I would like to have these fields and values in kibana :</p>
  
  <pre><code>DateTime : 2015-06-17 13:08:45
  LogType : INFO
  ModuleName : connectionpool
  Message :   connectionpool  Starting new HTTPS connection (1): SSX9FSMULE.algolia.net
  </code></pre>
  
  <p>The datetime field is not really important as by default ES include a timestamp</p>
  
  <p>I try this code :</p>
  
  <pre><code>if [type] == "mylog" {
      grok {
        match =&gt; { "message" =&gt; "%{MYLOGTIME:DateTime} %{LOGLEVEL:LogType} %{WORD:ModuleName}  %{GREEDYDATA:Message}" }
      }
    }
  </code></pre>
  
  <p>with a file mylog in the patterns directory containing this line :</p>
  
  <pre><code>MYLOGTIME %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}
  </code></pre>
  
  <p>But it didn't work and I got a no one of the above desired fields in kibana, only the message</p>
  
  <pre><code>2015-06-17 13:08:45      INFO    connectionpool  Starting new HTTPS connection (1): SSX9FSMULE.algolia.net
  </code></pre>
  
  <p>I tried this :</p>
  
  <pre><code>if [type] == "autosuggest" {
      grok {
        match =&gt; { "message" =&gt; "%{GREEDYDATA:Message}" }
        add_field =&gt; [ "LogType", "%{LOGLEVEL}" ]
        add_field =&gt; [ "ModuleNAme", "%{WORD}" ]
      }
    }
  </code></pre>
  
  <p>and got this in kibana :</p>
  
  <pre><code>LogType : %{LOGELEVEL}
  ModuleName : %{WORD}
  Message :  2015-06-17 13:08:45      INFO    connectionpool  Starting new HTTPS connection (1): SSX9FSMULE.algolia.net
  </code></pre>
  
  <p>And in the standard kibana message field I have the message above :</p>
  
  <pre><code> 2015-06-17 13:08:45      INFO    connectionpool  Starting new HTTPS connection (1): SSX9FSMULE.algolia.net
  </code></pre>
  
  <p>While I would like to have only the last part of my message (the part after module name) as message.</p>
  
  <p>I'm googling since several hours whitout success</p>
  
  <p>Please can some one explain how to get the part of the message I want with grok, and how to achieve what I'm trying to do here.</p>
  
  <p>Thanks</p>