# Extract timestamp from my log file along with loglevel?
**URL:** https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069
**Category:** Logstash
**Created:** [March 8, 2018, 12:55pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069 "2018-03-08T12:55:05Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@zakkhan](https://discuss.elastic.co/u/zakkhan)
#### Post date: [March 8, 2018, 12:55pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069/1 "2018-03-08T12:55:05Z")
I am using grok to extract the logtime alongwith loglevel but everytime i got grokparsefailure error. Although on individual selection they work fine.
Here are the details:
My log file:
**2018-01-31 07:35:49.899 [Information] Request starting HTTP/1.1 POST [http://ezcustomers-dev.ahcs.com/API/SiteUsers/GetAvailableSitesForUser](http://ezcustomers-dev.ahcs.com/API/SiteUsers/GetAvailableSitesForUser) application/json; charset=utf-8 92**
**2018-01-31 07:35:50.592 [Information] Executing action method "ezCustomerAPI.Controllers.SiteUserController.GetAvailableSitesForUser (ezCustomerAPI)" with arguments (["Models.SiteUsers.UserSiteByAppDTO"]) - ModelState is Valid**
Logstash.conf:
input {
beats{
port=\> "5044"
}
}
filter {
grok{
match =\>{"message"=\>"%{TIMESTAMP\_ISO8601:logtime}%{LOGLEVEL:Loglevel}"}
}
}
output {
stdout { codec =\> rubydebug }
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 8, 2018, 1:54pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069/2 "2018-03-08T13:54:41Z")
> I am using grok to extract the logtime alongwith loglevel but everytime i got grokparsefailure error.
Yes, because
- you're not taking the square brackets into account (it's "[Information]" not "Information"), and
- you don't have a space between %{TIMESTAMP\_ISO8601:logtime} and %{LOGLEVEL:Loglevel}.
> Although on individual selection they work fine.
What do you mean?
---
### Author:  [@zakkhan](https://discuss.elastic.co/u/zakkhan)
#### Post date: [March 8, 2018, 2:36pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069/3 "2018-03-08T14:36:20Z")
I mean When I only give grok this:
filter {
grok{
match =\>{"message"=\>"%{LOGLEVEL:Loglevel}"}
}
}
It works fine and also for timestamp.
---
### Author:  [@zakkhan](https://discuss.elastic.co/u/zakkhan)
#### Post date: [March 8, 2018, 2:37pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069/4 "2018-03-08T14:37:32Z")
However, I resolved it with this:
filter {
grok{
match =\>{"message"=\>"%{LOGLEVEL:Loglevel}"}
}
grok{
match =\>{"message"=\>"%{TIMESTAMP\_ISO8601:logtime}"}
}
}
But don't know if this is the best way to do this or not.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 8, 2018, 7:21pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069/5 "2018-03-08T19:21:02Z")
No, that's not the best way. Your original idea is fine but there are a few bugs in the expression, as I pointed out.
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [March 8, 2018, 10:53pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069/6 "2018-03-08T22:53:30Z")
When I use:
%{TIMESTAMP\_ISO8601:logtime} \[%{WORD:LogLevel}\]
The result is this:
```
{
"logtime": [
[
"2018-01-31 07:35:49.899"
]
],
"LogLevel": [
[
"Information"
]
]
}
```
If I use this:
%{TIMESTAMP\_ISO8601:logtime} \[%{LOGLEVEL:LogLevel}
I get this:
```
{
"logtime": [
[
"2018-01-31 07:35:49.899"
]
],
"LogLevel": [
[
"Info"
]
]
}
```
The %{LOGLEVEL:LogLevel} is translated into Info, now I do not know if you would expect the complete word "Information" but it is something to be aware of. Also as you can see, in the grok the last \] is not there. If you add it the grok filter will not match. Now it is not clear if you need more fields grok out of those log lines but is might pose a problem in the future.
I hope this helps.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 5, 2018, 10:53pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-my-log-file-along-with-loglevel/123069/7 "2018-04-05T22:53:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.