title: grok filter to select specific words from message field
body: <pre><code>input {
    file {
      path =&gt; "C:\Data\data.log"
      start_position =&gt; "beginning"
      sincedb_path =&gt; "NUL"
  
    }
  }
  filter {
      if [type] == "apache" {
          grok {
                      match =&gt; ["message", "%{COMBINEDAPACHELOG} "]
          }
      }mutate{
             remove_field =&gt; ["@timestamp"]
             remove_field =&gt; ["host"]
             remove_field =&gt; ["@version"]
             remove_field =&gt; ["path"]
      }   
  }
  
  output {
      elasticsearch{
      hosts =&gt; "localhost:9200"
      index =&gt; "logdata2"
      document_type =&gt; "logs"
      }
      stdout {codec =&gt; rubydebug}
  }
  </code></pre>
  
  <p>Here comes the problem I´ve run into:</p>
  
  <p>I want to just pick out some words but have never been able to get it right.</p>
  
  <p>What I wanted was just to get a string with timestamp that lies inside the message string. along with an other word, say OrderCreated.</p>
  
  <p>Is it possible to go this way to select specific string/word from message field?</p>
  
  <p>dissect worked just fine but now i´ve run in to a problem i didn´t had earlier.</p>
  
  <pre><code>dissect filter 
  input {
    file {
      path =&gt; "C:\Data\Logs\testrunning.log"
      start_position =&gt; "beginning"
      sincedb_path =&gt; "NUL"
  
    }
  }
    filter {
      dissect {
        mapping =&gt; {
          "message" =&gt; "%{ts} %{+ts} %{+ts} %{src} %{} : %{msg}"
        }
      }mutate { remove_field =&gt; "@timestamp" 
      remove_field =&gt; "pid"
      remove_field =&gt; "prog"
      remove_field =&gt; "@version"
      remove_field =&gt; "host"
      remove_field =&gt; "path"
      remove_field =&gt; "src"
    } 
  }
  output {
      elasticsearch{
      hosts =&gt; "localhost:9200"
      index =&gt; "logdata12"
      document_type =&gt; "logs"
      }
      stdout {codec =&gt; rubydebug}
  } 
  </code></pre>
  
  <p>The output is following. this is new to me, the "\r" part that wasnt there before.. is this familiar for anyone? how do i fix this part?</p>
  
  <pre><code>{
      "message" =&gt; "General 2018-05-17 15:47:33.149 : StatusInformationSomeData.Unsubscribe() \r",
          "msg" =&gt; "StatusInformationSomeData.Unsubscribe() \r",
           "ts" =&gt; "General 2018-05-17 15:47:33.149"
  }
  {
      "message" =&gt; "\r",
          "msg" =&gt; "\r",
           "ts" =&gt; "  "
  }
  </code></pre>