(Logstash, Grok) if field contains a specific word, then save some characters from it
<p>I have following filter which achieves most of my needs:</p>

filter {

<pre><code>grok {
    match =&gt; { "message" =&gt; [ "%{IPORHOST:clientip} - %{NGUSER:user} \[%{HTTPDATE:timestamp}\] (?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest}) %{NUMBER:response} (?:%{NUMBER:bytes}|-) (-|(%{DATA:referrer})) ] }
</code></pre>

<p>However, some (not all) logs I am parsing in contain the name of the channel a user is using on my Apache server.</p>

<p>A normal log including the word "channel" would be like this:</p>

<hr>

<p>10.40.80.11 - alex@example.com [03/Jan/2014:13:08:21 +0000] "GET /cgi-bin/feed/epg?channel=Bloomberg%20English&amp;date=2016-01-03 HTTP/1.1" 200 368 "<a href="http://example.net/cgi-bin/feed/epg" rel="nofollow">http://example.net/cgi-bin/feed/epg</a>" "Mozilla/5.0"</p>

<hr>

<p>The field "rawrequest" is saved on a separate field like this: </p>

<p>"GET /cgi-bin/feed/epg?channel=Bloomberg%20English&amp;date=2016-04-04 HTTP/1.1"</p>

<p>Question:
How can I save the names of the channels on a separate field considering not all logs contain the word channel in the field "rawrequest"?.</p>

<p>I have seen lots of examples but nothing similar.The character separating the channel to the rest of the string is "&amp;".
I would appreciate any help. </p>

<p>Solution:</p>

<pre><code>match =&gt; { "request" =&gt; [ "channel=(?&lt;Channels&gt;[^&amp;]+)" ] }
</code></pre>