# Creating grok filter to extract each field from Dao logs

**URL:** <https://discuss.elastic.co/t/creating-grok-filter-to-extract-each-field-from-dao-logs/239833>\
**Category:** Logstash\
**Created:** [July 3, 2020, 4:17pm UTC](https://discuss.elastic.co/t/creating-grok-filter-to-extract-each-field-from-dao-logs/239833 "2020-07-03T16:17:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kumarvivek633](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kumarvivek633/32/43303_2.png) [@kumarvivek633](https://discuss.elastic.co/u/kumarvivek633)\
**Post date:** [July 3, 2020, 4:17pm UTC](https://discuss.elastic.co/t/creating-grok-filter-to-extract-each-field-from-dao-logs/239833/1 "2020-07-03T16:17:22Z")

</div>

I want to create a grok filter for my dao logs but as its my first time i stuck wen its going to next line.

```
2020-07-02 01:13:34.279 [https-jsse-nio-9143-exec-1] [fc7ac7ef-47d6-48f0-b8b4-44f0889a944d] DEBUG QueryLogger - User 49. Session ID: fc7ac7ef-47d6-48f0-b8b4-44f0889a944d

	*** START query execution...

	Method Call : com.home.dao.repository.UserRepository.getUserByUserId:47

	Query : SELECT * from XYZ OUR.USER_ID =:userId

	Using value(s) : (userId:49)

	Time (in milliseconds) : 4

***STOP query execution.***

```

This is what my log looks like. I want to extract Date, Thread, Debug level, Session Id, User, the query , execution time, Method call and values.

This is what i have written till now but not able to proceed further.  
`%{TIMESTAMP_ISO8601:timestamp} *\[%{DATA:thread}] *\[%{DATA:sessionId}] *%{LOGLEVEL:level} %{DATA:Logger} -`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2020, 4:17pm UTC](https://discuss.elastic.co/t/creating-grok-filter-to-extract-each-field-from-dao-logs/239833/2 "2020-07-31T16:17:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.