# Customised Grok pattern
**URL:** https://discuss.elastic.co/t/customised-grok-pattern/118748
**Category:** Logstash
**Created:** [February 7, 2018, 4:49am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748 "2018-02-07T04:49:42Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 7, 2018, 4:49am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/1 "2018-02-07T04:49:42Z")
Hello
I m new to ELK. Can someone help me how to create a customized grok pattern for my logs.
Also is there any filter which I can use for (yyyy/mm/dd hh:mm:ss) format which I can use as my logs have this type of time stamp.
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [February 7, 2018, 5:55am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/2 "2018-02-07T05:55:47Z")
Hello @Gaurav_Agarwal,
Can you tell me what type of logs you are receiving, i mean what is the device type ?
Thanks & Regards,
Krunal
---
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 7, 2018, 9:52am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/3 "2018-02-07T09:52:11Z")
2018/02/06 08:00:00,071 | apt | mbs | INFO | 1-1967 | m.j.in.pfetch | | Message app\_ib\_eu1\_2a-37063-1516115745868-1:52847:2:1:16 dispatched to consumer app\_fom\_eu1\_3a-45305-1514429332298-1:98182:10:1
2018/02/06 08:00:00,071 | aptmucap003 | mb | INFO | 1-1991667 | m.j.out | | {"ActiveMQMessage":{"jmstimestamp":1517904000061,"jmsmessageID":"app\_ib\_eu1\_2a-37063-1516115745868-1:52847:2:1:16","jmscorrelationID":null,"jmsdestination":{"QualifiedName":"topic://topic.ext.event.update.V1","PhysicalName":"topic.ext.event.update.V1"},"jmsdeliveryMode":"PERSISTENT","jmsredelivered":false,"jmstype":null,"jmsexpiration":1517904900069,"jmspriority":4,"properties":{"deliveredBy":"ib.broker1\_app\_mb\_eu1\_1a","leg\_type":"DEPARTURE","legs\_ref\_airport":"APT\_CPH","apt\_customer\_id":"AITA-CPH","apt\_correlation\_id":"56f772b1-67b0-463a-9359-78f886c55c0a","peerOrigin":"tcp://172.25.48.24:50160","apt\_transaction\_originator":"COOPANS"}},"MessageDispatch":{"redeliveryCounter":0,"consumerId":"app\_fom\_eu1\_3a-45305-1514429332298-1:98182:10:1","dataStructureType":21,"deliverySequenceId":0,"rollbackCause":"","destination":"queue://clustered.fom.topic.ext.event.update.V1","commandId":0}}
2018/02/06 08:00:00,071 | aptmucap003 | mb | INFO | 1-1991583 | m.j.in | | {"jmstimestamp":1517904000061,"jmsmessageID":"app\_ib\_eu1\_2a-37063-1516115745868-1:52847:2:1:16","jmscorrelationID":null,"jmsdestination":{"QualifiedName":"topic://topic.ext.event.update.V1","PhysicalName":"topic.ext.event.update.V1"},"jmsdeliveryMode":"PERSISTENT","jmsredelivered":false,"jmstype":null,"jmsexpiration":1517932800061,"jmspriority":4,"properties":{"deliveredBy":"ib.broker1\_app\_mb\_eu1\_1a","leg\_type":"DEPARTURE","legs\_ref\_airport":"APT\_CPH","apt\_customer\_id":"AITA-CPH","apt\_correlation\_id":"56f772b1-67b0-463a-9359-78f886c55c0a","peerOrigin":"tcp://172.25.48.24:50160","apt\_transaction\_originator":"COOPANS"}}
---
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 7, 2018, 9:52am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/4 "2018-02-07T09:52:28Z")
this is one log file example
---
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 7, 2018, 10:23am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/5 "2018-02-07T10:23:42Z")
I was using \*\*%{TIMESTAMP\_ISO8601:timestamp} |%{HOSTNAME:hostname} | %{DATA:application} | %{LOGLEVEL:loglevel} _| 1-%{DATA:thread:int} | %{DATA:class} |%{DATA:corr} |%{GREEDYDATA:msg}"_
as the grok match but it is not able to take the timestamp.
As the timestamp format for **ISO8601** is **YYYY-MM-DD** and not what I require .
So is there a technique through which I can replace **'-'** by **'/'** in same ISO8601 or if u can suggest a possible pattern which I can use to match the logs.
Regards
Gaurav
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [February 7, 2018, 12:23pm UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/6 "2018-02-07T12:23:47Z")
try with CISCOTIMESTAMP
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [February 7, 2018, 12:24pm UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/7 "2018-02-07T12:24:43Z")
you can parse with separator |
in kv plugin you can use field\_split =\> "|" either value\_split =\> "|"
---
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 8, 2018, 6:02am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/8 "2018-02-08T06:02:47Z")
%{CISCOTIMESTAMP:date} %{HOSTNAME:hostname} | %{DATA:application} | %{LOGLEVEL:loglevel} \*| 1-%{DATA:thread:int} | %{DATA:class} \*|%{DATA:corr} |%{GREEDYDATA:msg}
It did not work with this can u suggest if any changes are required
Regards
Gaurav
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [February 9, 2018, 4:13am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/9 "2018-02-09T04:13:32Z")
your log is in .JSON format ?
---
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 9, 2018, 6:32am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/10 "2018-02-09T06:32:07Z")
nope
it is .logs only just that the time stamp is different from general the dates consist of a forward slash
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [February 9, 2018, 6:54am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/11 "2018-02-09T06:54:27Z")
{"deliveredBy":"ib.broker1\_app\_mb\_eu1\_1a","leg\_type":"DEPARTURE","legs\_ref\_airport":"APT\_CPH","apt\_customer\_id":"AITA-CPH","apt\_correlation\_id":"56f772b1-67b0-463a-9359-78f886c55c0a","peerOrigin":"tcp://172.25.48.24:50160","apt\_transaction\_originator":"COOPANS"}
This log easily parse by only json filter
---
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 9, 2018, 9:05am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/12 "2018-02-09T09:05:45Z")
this part of the log is not necessarily important what i want is loglevel and the timestamp so could you suggest me any filter for timestamp
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [February 9, 2018, 10:21am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/13 "2018-02-09T10:21:38Z")
> [@Gaurav\_Agarwal](#):
>
> 2018/02/06 08:00:00,071
2018/02/06 08:00:00,071
%{DATESTAMP} this is work fine but output in first 2 char is erase showing like this 18/02/06 08:00:00,071
---
### Author:  [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)
#### Post date: [February 12, 2018, 5:20am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/14 "2018-02-12T05:20:15Z")
Yes I used it already the thing is these logs have huge dependence on the timestamp and there are many graphs on the UI which are to be plotted in accordance with the timestamp.
So can you suggest how the customize grok model works as in how can I use patterns\_dir in my favour.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2018, 5:20am UTC](https://discuss.elastic.co/t/customised-grok-pattern/118748/15 "2018-03-12T05:20:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.