# Failed to filter using following grok pattern

**URL:** https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116
**Category:** Logstash
**Created:** [July 7, 2022, 12:47pm UTC](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116 "2022-07-07T12:47:12Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Rao\_Nelakurti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rao_nelakurti/32/98729_2.png) [@Rao\_Nelakurti](https://discuss.elastic.co/u/Rao_Nelakurti)
#### Post date: [July 7, 2022, 12:47pm UTC](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116/1 "2022-07-07T12:47:12Z")

</div>

Hi Team,

I'm trying filter following log message,

```auto
[2022-07-06T20:54:20.471-0700] [LogLevel:INFO] [ServerName:xyz.vcn.com] [IP:10.x.x.66][AppName:IoT] [FlowName: updateDevice] [ID:2022-07-06 20:54:20.471] [ECID:yja_Y1ega00000000] [MSG:Started]

```

Pattern that I'm trying,

```auto
%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:logLevel} %{DATA:host}.%{GREEDYDATA:domain} %{IP:clientIP} %{GREEDYDATA:message}

```

In my log, I have a [LogLevel:INFO] . Can someone please help me on this in building a grok match.

---

<div class="post-metadata">

### Author: ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [July 7, 2022, 12:55pm UTC](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116/2 "2022-07-07T12:55:29Z")

</div>

Hi @Rao_Nelakurti ,  
Please use below GROK:

```auto
\[%{TIMESTAMP_ISO8601:timestamp}\]\s*\[LogLevel:%{LOGLEVEL:logLevel}\]\s*\[ServerName:%{DATA:host}\]\s*\[IP:%{IP:ip}\]

```

```auto
{
  "timestamp": [
    [
      "2022-07-06T20:54:20.471-0700"
    ]
  ],
  "YEAR": [
    [
      "2022"
    ]
  ],
  "MONTHNUM": [
    [
      "07"
    ]
  ],
  "MONTHDAY": [
    [
      "06"
    ]
  ],
  "HOUR": [
    [
      "20",
      "07"
    ]
  ],
  "MINUTE": [
    [
      "54",
      "00"
    ]
  ],
  "SECOND": [
    [
      "20.471"
    ]
  ],
  "ISO8601_TIMEZONE": [
    [
      "-0700"
    ]
  ],
  "logLevel": [
    [
      "INFO"
    ]
  ],
  "host": [
    [
      "xyz.vcn.com"
    ]
  ],
  "ip": [
    [
      "10.1.2.66"
    ]
  ],
  "IPV6": [
    [
      null
    ]
  ],
  "IPV4": [
    [
      "10.1.2.66"
    ]
  ]
}

```

---

<div class="post-metadata">

### Author: ![Rao\_Nelakurti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rao_nelakurti/32/98729_2.png) [@Rao\_Nelakurti](https://discuss.elastic.co/u/Rao_Nelakurti)
#### Post date: [July 12, 2022, 8:06pm UTC](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116/3 "2022-07-12T20:06:15Z")

</div>

[magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)

Thanks, it's working. You can close it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 9, 2022, 8:06pm UTC](https://discuss.elastic.co/t/failed-to-filter-using-following-grok-pattern/309116/4 "2022-08-09T20:06:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.