# APM Logstash GROK **URL:** \ **Category:** Logstash\ **Created:** [March 8, 2018, 9:47am UTC](https://discuss.elastic.co/t/apm-logstash-grok/123037 "2018-03-08T09:47:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![mlala](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@mlala](https://discuss.elastic.co/u/mlala)\ **Post date:** [March 8, 2018, 9:47am UTC](https://discuss.elastic.co/t/apm-logstash-grok/123037/1 "2018-03-08T09:47:33Z")
Hi, I am trying to prepare filter for F5 ASM but using GROK Debugger i am facing issue related to same can anyone help with with proper logstash filter. i will paste the log file for your convenience. \<134\>Mar 8 12:40:06 DC-INT-SLB-02.zms.local ASM:"192.168.48.118","N/A","N/A","192.168.35.166","443","2018-03-08 12:40:06","Information Leakage","/Common/www.xxx.lm.sa.app/www.xxx.lm.sa\_vs","192.168.48.118%0","","192.168.90.14","POST","2016-04-10 10:03:56","/Common/www.xxx.lm.sa.app/www.xxx.lm.sa\_vs","HTTPS","","POST /sites/Home/wservices/JsonWebService.asmx/ReadHighLightsXml HTTP/1.1\r\nAccept: _/_\r\nContent-Type: application/json; charset=utf-8\r\nReferer: [https://www.xxx.lm.sa/sites/Home/\r\nAccept-Language:](https://www.xxx.lm.sa/sites/Home/%5Cr%5CnAccept-Language:) ar-BR\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko\r\nHost: www.xxx.lm.sa\r\nContent-Length: 16\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: \_ga=GA1.3.1270259754.1482313131; ASP.NET\_SessionId=idwovi550sj00445isqmdi2f; lang=ar-BR; BIGipServerPool\_dp\_2014\_80=2606606528.20480.0000; TS0145a324=0184b023f4e6a1b6cd88dd0017c4c93b24b52ad5fb24e435fe7e31a47f621ab3e7d8cd0108e60d4b4d276a1b3466c52b8143af3edf200722b6836db714f49e967fdf9dbcdaa8315187828a971fd19905 BR ML ---
**Author:** ![wa7son](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wa7son/32/21259_2.png) [@wa7son](https://discuss.elastic.co/u/wa7son)\ **Post date:** [March 8, 2018, 10:11am UTC](https://discuss.elastic.co/t/apm-logstash-grok/123037/2 "2018-03-08T10:11:16Z")
Hi, Thanks for reaching out. I think this question is better asked in the [Logstash category](https://discuss.elastic.co/c/logstash). Unfortunately I can't move it there, so could I get you to just re-post it and then I'll close this one afterwards. /thomas ---
**Author:** ![mlala](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@mlala](https://discuss.elastic.co/u/mlala)\ **Post date:** [March 8, 2018, 10:21am UTC](https://discuss.elastic.co/t/apm-logstash-grok/123037/3 "2018-03-08T10:21:30Z")
Hi, Thanks a lot for your response... i have re-posted it in logstash. you can not close this one. BR ML ---
**Author:** ![wa7son](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wa7son/32/21259_2.png) [@wa7son](https://discuss.elastic.co/u/wa7son)\ **Post date:** [March 8, 2018, 10:45am UTC](https://discuss.elastic.co/t/apm-logstash-grok/123037/4 "2018-03-08T10:45:24Z")
Closed on March 8, 2018, 10:45am UTC