title: Grok filter for AWS ELB
body: <p>I have the following filter in Logstash that parses AWS ELB access logs:</p>
  
  <pre><code>filter {
    grok {
      match =&gt; [ "message", '%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:loadbalancer} %{IP:client_ip}:%{NUMBER:client_port:int} (?:%{IP:backend_ip}:%{NUMBER:backend_port:int}|-) %{NUMBER:request_processing_time:float} %{NUMBER:backend_processing_time:float} %{NUMBER:response_processing_time:float} (?:%{NUMBER:elb_status_code:int}|-) (?:%{NUMBER:backend_status_code:int}|-) %{NUMBER:received_bytes:int} %{NUMBER:sent_bytes:int} "(?:%{WORD:verb}|-) (?:%{GREEDYDATA:request}|-) (?:HTTP/%{NUMBER:httpversion}|-( )?)" "%{DATA:userAgent}"( %{NOTSPACE:ssl_cipher} %{NOTSPACE:ssl_protocol})?' ]
    }
  }
  </code></pre>
  
  <p>which results in various fields in Elasticsearch, one being the <em>request</em> filed with a possible value of</p>
  
  <pre><code>https://api.example.net:443/v2/domain.com/actions?somefield=somevalue
  </code></pre>
  
  <p>Is there a way to add a second grok filter using a regex to operate on that field, before it gets indexed to ES such that <em>domain.com</em> and <em>v2</em> are extracted and indexed into their own separate fields ?</p>