# Change Log format

**URL:** <https://discuss.elastic.co/t/change-log-format/344476>\
**Category:** Kibana\
**Tags:** search\
**Created:** [October 5, 2023, 12:31pm UTC](https://discuss.elastic.co/t/change-log-format/344476 "2023-10-05T12:31:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Suleman\_Ahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suleman_ahmed/32/122022_2.png) [@Suleman\_Ahmed](https://discuss.elastic.co/u/Suleman_Ahmed)\
**Post date:** [October 5, 2023, 12:31pm UTC](https://discuss.elastic.co/t/change-log-format/344476/1 "2023-10-05T12:31:16Z")

</div>

Hello!

I want to change format of below mentioned log. I am new to Elk any help will be much appreciated. Thanks

[Mon Oct 02 13:14:00.967345 2023] [security2:error] [pid 186:tid 140439170467520] [client 192.168.76.181:51316] [client 192.168.76.181] ModSecurity: Warning. Pattern match "((?:[~!@#\$%\^&\_\(\)\-\+=\{\}\[\]\|:;"'\xc2\xb4\xe2\x80\x99\xe2\x80\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`\<\>]_ ?){6})" at ARGS:data.accountNumber. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1414"] [id "942431"] [msg "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)"] [data "Matched Data: -A-010-01-01-1000- found within ARGS:data.accountNumber: 1014-A-010-01-01-1000-8"] [severity "WARNING"] [ver "OWASP\_CRS/3.3.5"] [tag "modsecurity"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP\_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/3"] [hostname "waf"] [uri "/fsm/TNS\_FT\_1\_A\_VL\_N"] [unique\_id "ZRrCGHUNdbJ411i8RvA2ZgAAAMA"], referer: [https://staging.abc-faceit.org/TNS\_FT\_1\_A\_VL\_N\_Super8](https://staging.abc-faceit.org/TNS_FT_1_A_VL_N_Super8)

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [October 6, 2023, 12:35pm UTC](https://discuss.elastic.co/t/change-log-format/344476/2 "2023-10-06T12:35:17Z")

</div>

Hi @Suleman_Ahmed,

Great to hear you're using ELK. How are you ingesting your logs into Elasticsearch? And can you give an example of what transformations that you want to apply?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2023, 12:35pm UTC](https://discuss.elastic.co/t/change-log-format/344476/3 "2023-11-03T12:35:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.