# Filter for logstash **URL:** \ **Category:** Logstash\ **Created:** [December 5, 2016, 10:10am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016 "2016-12-05T10:10:20Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Deepak\_Mann](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Post date:** [December 5, 2016, 10:10am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/1 "2016-12-05T10:10:20Z")
launch TIMESTAMP START: 2016.11.15 05:30:23 INFO: 200000 packets. Current packet is class com.navtech.kernel.flat.FlatCombo [Loader] [tstamp: 1866 time: 1851.4 (30:51) split: 03.2] [Memory: 3.320G total: 22.20G free: 18.88G] INFO: [BatchValidationCommand] [tstamp: 4992 time: 39.1 split: 00.0][Memory:18.95G total: 37.49G free: 18.54G] INFO: Done executing all batch validations. [ValidationService] [tstamp: 4992 time: 38.7 split: 38.7] [Memory: 18.95G total: 37.49G free: 18.54G][save rule violations] [tstamp: 4998 time: 4997.6 (1:23:17) split: 4997.6 (1:23:17)] [Memory:23.25G total: 37.49G free: 14.24G] launch TIMESTAMP END: 2016.11.15 06:53:45 what will be the filter for this log, if I want to extract data like timestamp, time consumed per process and memory? Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 5, 2016, 10:51pm UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/2 "2016-12-05T22:51:50Z")
What have you tried? ---
**Author:** ![Deepak\_Mann](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Post date:** [December 6, 2016, 5:05am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/3 "2016-12-06T05:05:37Z")
INFO: 200000 packets. Current packet is class com.navtech.kernel.flat.FlatCombo [Loader] [tstamp: 1866 time: 1851.4 (30:51) split: 03.2] [Memory: 3.320G total: 22.20G free: 18.88G] for this, I tried \A(?:%{LOGLEVEL:level})%{GREEDYDATA:message}\s+([%{WORD:loglevel}]\s+)+([%{GREEDYDATA:ts}]\s+)+([%{GREEDYDATA:mem}]) but now what I'm missing is to extract the "Memory:" and "total:" so how will i write regex for that ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 6, 2016, 6:32am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/4 "2016-12-06T06:32:12Z")
Having more than one GREEDYDATA pattern in an expression can be problematic as well as inefficient. What are expecting the parsed event to look like? ---
**Author:** ![Deepak\_Mann](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Post date:** [December 6, 2016, 7:17am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/5 "2016-12-06T07:17:01Z")
Hi, I'm expecting it to look like log level message class memory used/memory free and timestamp further I enhanced it to \A(?:%{LOGLEVEL:level})%{GREEDYDATA:message}\s(?:%{JAVACLASS:caller\_class})\s+([%{WORD:log}]\s+)+([%{DATA:ts}]\s+)+([%{DATA:mem}]) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 6, 2016, 7:36am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/6 "2016-12-06T07:36:37Z")
What exactly do you expect to capture in those fields? Can you create an expected JSON document based on the example event? ---
**Author:** ![Deepak\_Mann](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Post date:** [December 6, 2016, 8:32am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/8 "2016-12-06T08:32:09Z")
I was using the grok debugger to verify my regex pattern, I want the data tokenized so that I can visualize it in Kibana like process vs time or time vs memory graph ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 6, 2016, 8:36am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/9 "2016-12-06T08:36:52Z")
Can you please create an example JSON document that show how you would like the example event parsed and post it here? This will make it a lot easier for us to help you. ---
**Author:** ![Deepak\_Mann](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Post date:** [December 6, 2016, 8:39am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/10 "2016-12-06T08:39:46Z")
{ "level": [ "INFO" ], "message": [ "200000 packets. Current packet is class" ], "caller\_class": [ "com.navtech.kernel.flat.FlatCombo" ], "loglevel": [ "Loader" ], "tstamp": [ "1866" ], "memory": [ "3.320" ], "total": [ "22.20" ] } This was the expectation from my command ---
**Author:** ![Deepak\_Mann](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Post date:** [December 6, 2016, 9:43am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/11 "2016-12-06T09:43:37Z")
^(?:%{LOGLEVEL:level}):\s\*%{DATA:message}\s\*(?:%{JAVACLASS:caller\_class})\s+[%{WORD:loglevel}]\s+([\s\*\S+\s+%{BASE10NUM:tstamp}._?]\s+)+([\s_\S+\s+%{BASE10NUM:memory}\S\*\s+\S+\s+%{BASE10NUM:total}.\*?]) I got the result fine with this from stackoverflow, but how shall I use this grok in the filter command in logstash conf ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 6, 2016, 9:55am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/12 "2016-12-06T09:55:11Z")
Use grok to separate out the various parts into separate fields. You should then e.g. be able to use the kv filter to parse out memory and total from the last part, although you may use a mutate filter to clean the fields up and remove the 'G' training the number. ---
**Author:** ![Deepak\_Mann](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Post date:** [December 6, 2016, 10:21am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/13 "2016-12-06T10:21:36Z")
I'm sorry I didn't understand what you meant to say how shall I use grok to separate it into fields, I used [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) to match my pattern and the particular pattern matched, but how shall I use this Info can you provide some URLs or wiki links or videos for reference ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 3, 2017, 10:21am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016/14 "2017-01-03T10:21:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.