# Create a ingest pattern form Postgresql

**URL:** <https://discuss.elastic.co/t/create-a-ingest-pattern-form-postgresql/376187>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 20, 2025, 2:23pm UTC](https://discuss.elastic.co/t/create-a-ingest-pattern-form-postgresql/376187 "2025-03-20T14:23:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![brunopsitech](https://avatars.discourse-cdn.com/v4/letter/b/eb9ed0/32.png) [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\
**Post date:** [March 20, 2025, 2:23pm UTC](https://discuss.elastic.co/t/create-a-ingest-pattern-form-postgresql/376187/1 "2025-03-20T14:23:43Z")

</div>

I need change file /usr/share/filebeat/module/postgresql/log/ingest/pipeline-log.yml to my postgresql log customization, some one can help ?  
PostgreSQL configuration:  
...  
log\_connections = on  
log\_hostname = off  
log\_line\_prefix = 'user=%u database=%d host=%h application=%a command=%i '  
log\_statement = 'all'

Output Log example:  
Mar 20 11:01:21 h200137222138 postgres[73995]: [18-1] user=postgres database=teste host=[local] application=psql command=idle LOG: comando: select \* from students;

Collums of log:  
[DATE] [HOSTNAME] [PROCESS]: [?] [user=%u] [database=%d] [host=%h] [application=%a] [command=%i]

How can i change pipeline-log.yml patterns to this log output ?

Default file:  
escription: Pipeline for parsing PostgreSQL logs.  
processors:

- grok:  
field: raw\_message  
ignore\_missing: true  
patterns:
  - '^([%{NUMBER:process.pid:long}(-%{BASE16FLOAT:postgresql.log.session\_line\_number:long})?] (([%{USERNAME:user.name}]@[%{POSTGRESQL\_DB\_NAME:postgresql.log.database}]|%{USERNAME:user.name}@%{POSTGRESQL\_DB\_NAME:postgresql.log.database}) )?)?%{WORD:log.level}: (?:%{POSTGRESQL\_ERROR:postgresql.log.sql\_state\_code}|%{SPACE})(duration: %{NUMBER:temp.duration:float} ms( %{POSTGRESQL\_QUERY\_STEP}: %{GREEDYDATA:postgresql.log.query})?|statement: %{GREEDYDATA:postgresql.log.query}|: %{GREEDYDATA:message}|%{GREEDYDATA:message})'  
pattern\_definitions:  
GREEDYDATA: |-  
(.|  
| )\*  
POSTGRESQL\_DB\_NAME: '[a-zA-Z0-9\_]+[a-zA-Z0-9\_$]\*'  
POSTGRESQL\_QUERY\_STEP: '%{WORD:postgresql.log.query\_step}(?: | %{WORD:postgresql.log.query\_name})?'  
POSTGRESQL\_ERROR: '\b[A-Z0-9]{5}\b'