# Difficult log line

**URL:** https://discuss.elastic.co/t/difficult-log-line/93706
**Category:** Logstash
**Created:** [July 19, 2017, 7:10am UTC](https://discuss.elastic.co/t/difficult-log-line/93706 "2017-07-19T07:10:01Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Kubeksz](https://avatars.discourse-cdn.com/v4/letter/k/67e7ee/32.png) [@Kubeksz](https://discuss.elastic.co/u/Kubeksz)
#### Post date: [July 19, 2017, 7:10am UTC](https://discuss.elastic.co/t/difficult-log-line/93706/1 "2017-07-19T07:10:01Z")

</div>

I'm a new user of ELK stack. I've got a little problem with filtering out specific section from my log.

Sample log:

```
 [2017-05-30 13:58:09,336] INFO [com.qwerty.test.core.services.impl.order.OrderEntryService (OrderEntryService.java:5426) [http-/0.0.0.0:1111-111] {{CT,1496145487308}{IP,111.11.111.11}{JTX,1511059/176275501}{OBJT,goodsMovement.reportsUtils.ConsignmentStocksList}{OPT,SQ}{PID,111111}{SS,SSCPLTMPRODPL}{TRT,SAP_LOGISTIC_REPORT}{UID,StudentSaSo-8}}: Saving order: K1010101

```

and my grok:

```
grok {
		match => { "message" => "(?<log_timestamp>%{YEAR}-%{MONTHNUM2}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND},%{NONNEGINT})\] %{LOGLEVEL:loglevel} * \[(?<logger>[A-Za-z0-9$_.]+)\] \(%{JAVAFILE:class}:%{NONNEGINT:line}\) \[%{NOTSPACE:thread}\] %{GREEDYDATA:log_message}"}
	}

```

so i need filter out this section from my log:

{{CT,1496145487308}{IP,111.11.111.11}{JTX,1511059/176275501}{OBJT,goodsMovement.reportsUtils.ConsignmentStocksList}{OPT,SQ}{PID,111111}{SS,SSCPLTMPRODPL}{TRT,SAP\_LOGISTIC\_REPORT}{UID,StudentSaSo-8}}:

I try use patterns from [https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns](https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns) but it does not work for me and also i try crate own pattern and it only works for first section ( {{CT,1496145487308} ).

my regexp:

```
(?:[\{{][^\}]*,[^\}]*\})

```

so please help me guys, i'm totally blocked by this issue

---

<div class="post-metadata">

### Author: ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [July 19, 2017, 12:14pm UTC](https://discuss.elastic.co/t/difficult-log-line/93706/2 "2017-07-19T12:14:19Z")

</div>

There are several syntax errors with your grok pattern, which actually fails to compile:

E.g. Mixing what I presume are regex capture groups with grok expressions (also MONTHNUM2 is not a valid pattern)

```auto

```

For reference, you can use [grokdebug](http://grokdebug.herokuapp.com/) for on-the-fly pattern testing.  
This should work

```auto
grok {
		match => { "message" => "\[%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND},%{NONNEGINT}\] %{WORD:loglevel} \[%{NOTSPACE:logger} \(%{JAVAFILE:class}:%{NONNEGINT:line}\) \[%{NOTSPACE:thread}\] %{GREEDYDATA:log_message}"}
	}
```

---

<div class="post-metadata">

### Author: ![Kubeksz](https://avatars.discourse-cdn.com/v4/letter/k/67e7ee/32.png) [@Kubeksz](https://discuss.elastic.co/u/Kubeksz)
#### Post date: [July 20, 2017, 6:37am UTC](https://discuss.elastic.co/t/difficult-log-line/93706/3 "2017-07-20T06:37:01Z")

</div>

thank's for your reply but i write about different thing. I didn't saw that i don't mentioned about with which section i've got problem... 😕

But thanks a lot for your help with another mistake that i've done 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2017, 6:37am UTC](https://discuss.elastic.co/t/difficult-log-line/93706/4 "2017-08-17T06:37:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.