# Custom logging format

**URL:** <https://discuss.elastic.co/t/custom-logging-format/31151>\
**Category:** Logstash\
**Created:** [September 28, 2015, 7:00am UTC](https://discuss.elastic.co/t/custom-logging-format/31151 "2015-09-28T07:00:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![deepak1](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@deepak1](https://discuss.elastic.co/u/deepak1)\
**Post date:** [September 28, 2015, 7:00am UTC](https://discuss.elastic.co/t/custom-logging-format/31151/1 "2015-09-28T07:00:58Z")

</div>

## lets say i have a custom logging format like below:- format is:- year timestamp thread log\_level class\_name method\_name message

## 2015-09-24 12:06:37.051 [catalina-exec-10] DEBUG ActClientServerDAO - [retSubsKeyInfo(String), [Server Id -\> 12345]]... 2015-09-24 12:06:37.051 [catalina-exec-10] DEBUG SubsKeyDAO - [select(String), [ENTRY : SubscriptionKey -\> dfsdfsdfrwrxdsf]]... 2015-09-24 12:06:37.051 [catalina-exec-10] DEBUG DBHandler - [getConn(pDBID)::, [PTTID::, 12345]]... 2015-09-24 12:06:37.051 [catalina-exec-5] DEBUG DBConHandler - [getConnection(String), [Entered Get Connection for , 12345]]... 2015-09-24 12:06:37.051 [catalina-exec-5] DEBUG DBConHandler - [getConnection(String), [Leaving Get Connection for , 12345]]...

How can i create custom grok filter based on my sample logs.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 28, 2015, 7:46am UTC](https://discuss.elastic.co/t/custom-logging-format/31151/2 "2015-09-28T07:46:12Z")

</div>

If you're not fluent with grok expressions (i.e. regular expressions with some extra fluff) I highly recommend using [http://grokconstructor.appspot.com](http://grokconstructor.appspot.com) to build your expressions step by step. You'll want to start with something like this:

```
filter {
  grok {
    match => [
      "message",
      "^%{TIMESTAMP_ISO8601:timestamp} ..."
    ]
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/custom-logging-format/31151/3 "2017-07-06T05:27:52Z")

</div>