# Assistance requried for Logstash filter with GROK **URL:** \ **Category:** Elasticsearch\ **Created:** [February 25, 2015, 4:55am UTC](https://discuss.elastic.co/t/assistance-requried-for-logstash-filter-with-grok/22370 "2015-02-25T04:55:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\ **Post date:** [February 25, 2015, 4:55am UTC](https://discuss.elastic.co/t/assistance-requried-for-logstash-filter-with-grok/22370/1 "2015-02-25T04:55:32Z")
Hi, I'm trying to filter below weblogic log using Logtrash filter GROK. [2015-02-24T19:17:31.238-05:00] [SOA1] [NOTIFICATION] [] [oracle.soa.b2b.engine] [tid: DaemonWorkThread: '4' of WorkManager: 'wm/SOAWorkManager'] [userId:] [ecid: d070755914343597:13c3dcbc:14bb6caf2c7:-8000-0000000000000006,1:30619] [APP: soa-infra] BatchRepositorygetCountBatchNames : tid = 176 conn = [weblogic.jdbc.wrapper.JTAConnection\_weblogic\_jdbc\_wrapper\_XAConnection\_oracle\_jdbc\_driver\_LogicalConnection-SOADataSource-140550, oracle.jdbc.driver.LogicalConnection@1a08b2a3] [2015-02-24T19:18:03.358-05:00] [SOA1] [NOTIFICATION] [] [oracle.soa.adapter] [tid: DaemonWorkThread: '16' of WorkManager: 'wm/SOAWorkManager'] [userId: \ "stdin-type" } file { type =\> "SOA1-diagnostic" path =\> [""] } } filter { multiline { type =\> "SOA1-diagnostic" pattern =\> "^[%{TIMESTAMP\_ISO8601]" negate =\> true what =\> "previous" } grok { type =\> "SOA1-diagnostic" pattern =\> ["[%{TIMESTAMP\_ISO8601:timestamp}]\s\*[%{WORD:Managed\_Server}]\s\*%{GREEDYDATA:log\_message}"] add\_field =\> ["Log", "SOA1-diagnostic"] } } output { elasticsearch { host =\> } } 1. input { stdin { type =\> "stdin-type" } file { type =\> "SOA1-diagnostic" path =\> ["/mnt/orasoa2t/logs/soa2t\_domain/SOA1-diagnostic.log"] } } filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:wls\_timestamp} %{GREEDYDATA:log\_message}" } } ``` } ``` output { elasticsearch { host =\> usncx135 } } Please assist me. Thanks in advance. Regards, Bharath -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/29067e5c-cddb-49e3-813c-c1dccfce48fc%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/29067e5c-cddb-49e3-813c-c1dccfce48fc%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 25, 2015, 6:42am UTC](https://discuss.elastic.co/t/assistance-requried-for-logstash-filter-with-grok/22370/2 "2015-02-25T06:42:47Z")
On Wednesday, February 25, 2015 at 05:55 CET, Bharath Paruchuri [bharath.1930@gmail.com](mailto:bharath.1930@gmail.com) wrote: > I'm trying to filter below weblogic log using Logtrash filter GROK. Please post Logstash question to the logstash-users mailing list. [https://groups.google.com/forum/#!forum/logstash-users](https://groups.google.com/forum/#!forum/logstash-users) [...] > multiline { > type =\> "SOA1-diagnostic" > pattern =\> "^[%{TIMESTAMP\_ISO8601]" Couldn't help noticing that there's a } missing here. [...] -- Magnus Bäck | Software Engineer, Development Tools [magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) | Sony Mobile Communications -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/20150225064247.GB25857%40seldlx20533.corpusers.net](https://groups.google.com/d/msgid/elasticsearch/20150225064247.GB25857%40seldlx20533.corpusers.net). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\ **Post date:** [February 25, 2015, 3:27pm UTC](https://discuss.elastic.co/t/assistance-requried-for-logstash-filter-with-grok/22370/3 "2015-02-25T15:27:23Z")
Yes. That helped me. Thanks. On Wed, Feb 25, 2015 at 12:12 PM, Magnus Bäck [magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) wrote: > On Wednesday, February 25, 2015 at 05:55 CET, > Bharath Paruchuri [bharath.1930@gmail.com](mailto:bharath.1930@gmail.com) wrote: > > > I'm trying to filter below weblogic log using Logtrash filter GROK. > > Please post Logstash question to the logstash-users mailing list. > > [Redirecting to Google Groups](https://groups.google.com/forum/#!forum/logstash-users) > > [...] > > > multiline { > > type =\> "SOA1-diagnostic" > > pattern =\> "^[%{TIMESTAMP\_ISO8601]" > > Couldn't help noticing that there's a } missing here. > > [...] > > -- > Magnus Bäck | Software Engineer, Development Tools > [magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) | Sony Mobile Communications > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/M8N7KsefD-s/unsubscribe](https://groups.google.com/d/topic/elasticsearch/M8N7KsefD-s/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/20150225064247.GB25857%40seldlx20533.corpusers.net](https://groups.google.com/d/msgid/elasticsearch/20150225064247.GB25857%40seldlx20533.corpusers.net) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CA%2BRL%2BAW3Rx2pfAGiHhPmL9YgnPcEufcgUHkqbhSnhHd0a7qSEw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CA%2BRL%2BAW3Rx2pfAGiHhPmL9YgnPcEufcgUHkqbhSnhHd0a7qSEw%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:30am UTC](https://discuss.elastic.co/t/assistance-requried-for-logstash-filter-with-grok/22370/4 "2017-07-06T00:30:12Z")