# Apply grok pattern based on the log file path

**URL:** <https://discuss.elastic.co/t/apply-grok-pattern-based-on-the-log-file-path/334395>\
**Category:** Logstash\
**Created:** [May 26, 2023, 6:10am UTC](https://discuss.elastic.co/t/apply-grok-pattern-based-on-the-log-file-path/334395 "2023-05-26T06:10:46Z")\
**Posts on this page:** 2\
**Page:** 3

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 15, 2023, 4:29pm UTC](https://discuss.elastic.co/t/apply-grok-pattern-based-on-the-log-file-path/334395/42 "2023-06-15T16:29:21Z")

</div>

Normally the date field should always have: date, time in ms set to UTC. For instance: `2023-06-15T16:44:01.123Z`. It's not easy to understand why you have separate date and time. Most likely

Please do next for a single index which you prefer:

1. Add rubydebug to see how data looks like before ends in ES.

```auto
output {
    stdout { codec => rubydebug{} }
  elasticsearch { ...
  }
}

```

1. Copy the final grok version for index where data are not parse.
2. Run LS and copy how data looks originally and parsed in fields where data are not parse.

PS. Sorry for delay.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2023, 4:29pm UTC](https://discuss.elastic.co/t/apply-grok-pattern-based-on-the-log-file-path/334395/43 "2023-07-13T16:29:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/apply-grok-pattern-based-on-the-log-file-path/334395.md?page=2)