# Best approach to parse this line into tokens

**URL:** <https://discuss.elastic.co/t/best-approach-to-parse-this-line-into-tokens/161715>\
**Category:** Logstash\
**Created:** [December 20, 2018, 3:27pm UTC](https://discuss.elastic.co/t/best-approach-to-parse-this-line-into-tokens/161715 "2018-12-20T15:27:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![swright-eti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/swright-eti/32/38743_2.png) [@swright-eti](https://discuss.elastic.co/u/swright-eti)\
**Post date:** [December 20, 2018, 3:27pm UTC](https://discuss.elastic.co/t/best-approach-to-parse-this-line-into-tokens/161715/1 "2018-12-20T15:27:07Z")

</div>

I am trying to figure out the best approach to parse this line. I want a couple of pieces of information parsed into tokens, and other stripped away. This was captured from the Logstash log when it was sent by Filebeat.

```
ERROR: 12/19/18 02:20:13 PID=3111 (ScreenPopServer 1000 1)\nmain:Exception: org.I0Itec.zkclient.exception.ZkTimeoutException: Unable to connect to zookeeper server within timeout: 50000\n------------------------------------------------------------------------------

```

I want the  
--word ERROR as log\_level  
--number 3111 as pid  
--word ScreenPopServer as process\_name  
--number 1000 as controller\_number  
--number 1 as instance\_number

I want to strip the dashes off completely.

This is what I have so far:

```
%{WORD:log_level}: %{DATE_US}.* %{TIME}.* %{WORD}.*=%{NUMBER:pid} \(%{WORD:process_name} %{NUMBER:controller_number} %{NUMBER:instance_number}\)\\n

```

This issue I am having is getting the message part up to the dashes. This occurs after the first \n char, but I cant seem to get a match. If I add a word, the match fails, but I dont know why.

```
%{WORD:log_level}: %{DATE_US}.* %{TIME}.* %{WORD}.*=%{NUMBER:pid} \(%{WORD:process_name} %{NUMBER:controller_number} %{NUMBER:instance_number}\)\\n%{WORD}.*

```

I am using this to my matches - [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

---

<div class="post-metadata">

**Author:** ![swright-eti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/swright-eti/32/38743_2.png) [@swright-eti](https://discuss.elastic.co/u/swright-eti)\
**Post date:** [December 20, 2018, 4:39pm UTC](https://discuss.elastic.co/t/best-approach-to-parse-this-line-into-tokens/161715/2 "2018-12-20T16:39:19Z")

</div>

Ok to remove the slashes I used mutate and gsub. That is the first step in my filter.

```
mutate {
    gsub => [
        # Replace the line of dashes
        "message", "-+$", ""
    ]
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2019, 4:39pm UTC](https://discuss.elastic.co/t/best-approach-to-parse-this-line-into-tokens/161715/3 "2019-01-17T16:39:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.