# Creating index pattern

**URL:** <https://discuss.elastic.co/t/creating-index-pattern/177001>\
**Category:** Logstash\
**Created:** [April 16, 2019, 5:42am UTC](https://discuss.elastic.co/t/creating-index-pattern/177001 "2019-04-16T05:42:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kalyan\_MB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalyan_mb/32/42974_2.png) [@Kalyan\_MB](https://discuss.elastic.co/u/Kalyan_MB)\
**Post date:** [April 16, 2019, 5:42am UTC](https://discuss.elastic.co/t/creating-index-pattern/177001/1 "2019-04-16T05:42:45Z")

</div>

Hi,

## i have the log format as below, log file:

## pid: 1131 start: 0 stacksize: 0 breaksize: 9 command: tuned arguments: /usr/bin/python -Es /usr/sbin/tuned -l -P pid: 1163 start: 0 stacksize: 0 breaksize: 11 command: redis-server arguments: /usr/bin/redis-server \*💯

filter in logstash.conf file

* * *

## else if [log\_type] == "pro\_logs" { dissect { mapping =\> {'message' =\> '%{pro\_id-\>} %{start-\>} %{stack\_size-\>} %{breaksize\_val-\>} %{command-\>} %{msg-\>}'}} } }

is this filter correct, because i am not able to see the proper parsed output in kibana for this log file.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 16, 2019, 12:09pm UTC](https://discuss.elastic.co/t/creating-index-pattern/177001/2 "2019-04-16T12:09:40Z")

</div>

No, it is not correct. Try

```
dissect { mapping => { "message" => "pid: %{pid} start: %{start} stacksize: %{stacksize} breaksize: %{breaksize} command: %{command} arguments: %{arguments}" } }
```

---

<div class="post-metadata">

**Author:** ![Kalyan\_MB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalyan_mb/32/42974_2.png) [@Kalyan\_MB](https://discuss.elastic.co/u/Kalyan_MB)\
**Post date:** [April 17, 2019, 2:24pm UTC](https://discuss.elastic.co/t/creating-index-pattern/177001/3 "2019-04-17T14:24:01Z")

</div>

Thanks @Badger the solution didn't solve my problem though, i am using below filter with grok RE.

## grok { match =\> { "message" =\> "%{DATA}: %{INT:pid\_value} %{DATA}: %{INT:start} %{DATA}: %{INT:stacksize} %{DATA}: %{INT:breaksize} %{DATA}: %{WORD:command\_val} %{DATA}: %{WORD:argument\_val} %{GREEDYDATA:args}" }

filebeat.yml:

- input\_type: log  
paths:  
#- /home/vankata/190\_APS\_QUALIFICATION/kalyan\_elk\_logs/new\_working\_dir/Process\_heap\*.txt
  - /home/vankata/190\_APS\_QUALIFICATION/kalyan\_elk\_logs/new\_working\_dir/test\_dir/Process\_heap\*.txt  
encoding: utf-8  
fields\_under\_root: true  
document\_type: log  
fields:  
service\_name: pro  
app\_name: cfx\_perf\_logs  
log\_type: pro\_logs

* * *

Process\_heap\_09\_09\_23\_40.txt Process\_heap\_09\_09\_07\_40.txt these two files present in the log directory.

file diff between above files..

Problems that i am facing with above configurations  
1.\_grokparsefailure for both the file inputs initially.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c01fcfb525c247e71a126097d70cede2d6518b12.png)  
2.If the log directory consists more than 50 files, index pattern is not done properly.  
Eg: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/8/48d0f54a33ac207332f8765e7505b6cdd09eab8f.png)  
this doesnt have index for icscf where as input file has an entry for the same.  
[root@perfDatastore new\_working\_dir]# cat Process\_heap\_09\_09\_21\_40.txt |grep icscf | more  
pid: 25925 start: 0 stacksize: 0 breaksize: 17 command: icscf arguments: IMS\_ICSCF01 -n IMS\_CMPROXY  
pid: 25926 start: 0 stacksize: 0 breaksize: 19 command: icscf arguments: IMS\_ICSCF02 -n IMS\_CMPROXY  
pid: 25927 start: 0 stacksize: 0 breaksize: 17 command: icscf arguments: IMS\_ICSCF03 -n IMS\_CMPROXY

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2019, 2:24pm UTC](https://discuss.elastic.co/t/creating-index-pattern/177001/4 "2019-05-15T14:24:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.