# Getting logs from a TOOK having \>15ms using logstash? **URL:** \ **Category:** Logstash\ **Created:** [May 9, 2017, 1:39pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103 "2017-05-09T13:39:07Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Post date:** [May 9, 2017, 1:39pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103/1 "2017-05-09T13:39:07Z")
HI, LOGS: ``` [2017-01-14 10:48:06,848][WARN][index.search.slowlog.query] [yaswanth] [bank][0] took[27.8ms], took_millis[27], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[], [2017-01-14 10:48:06,851][WARN][index.search.slowlog.query] [yaswanth] [bank][3] took[33.7ms], took_millis[33], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[], ``` I am trying to get the logs whose TOOK field is \>15ms . I used the below config ``` input { file { path => "C:\Users\571952\Desktop\pica.txt" start_position => "beginning" } } filter { grok { match => [ "message", "\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]\[%{LOGLEVEL:LEVEL}%{SPACE}\]\[%{DATA:QUERY}\]%{SPACE}\[%{DATA:QUE RY1}\]%{SPACE}\[%{DATA:INDEX-NAME}\]\[%{DATA:SHARD}\]%{SPACE}took\[%{DATA:TOOK}\],%{SPACE} took_millis\[%{DATA:TOOKM}\], types\[%{DATA:types}\], stats\[%{DATA:stats}\], search_type \[%{DATA:search_type}\], total_shards\[%{NUMBER:total_shards}\], source\[%{DATA:source_query}\], extra_source\[%{DATA:extra_source}\],"] } if [TOOK] > 15ms { mutate { add_tag => "slowresponse" } } else { drop { } } } output { stdout { codec => rubydebug } } ``` I am getting error like this: ``` ←[31mfetched an invalid config {:config=>"input {\n file {\n path => \"C:\\U sers\\571952\\Desktop\\pica.txt\"\n start_position => \"beginning\"\n }\n}\n \nfilter {\n grok {\n match => [ \"message\", \"\\[%{TIMESTAMP_ISO8601: TIMESTAMP}\\]\\[%{LOGLEVEL:LEVEL}%{SPACE}\\]\\[%{DATA:QUERY}\\]%{SPACE}\\[%{DATA :QUERY1}\\]%{SPACE}\\[%{DATA:INDEX-NAME}\\]\\[%{DATA:SHARD}\\]%{SPACE}took\\[%{D ATA:TOOK}\\],%{SPACE}took_millis\\[%{DATA:TOOKM}\\], types\\[%{DATA:types}\\], s tats\\[%{DATA:stats}\\], search_type\\[%{DATA:search_type}\\], total_shards\\[%{ ``` Even i tried with removing `ms` Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 2:09pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103/2 "2017-05-09T14:09:12Z")
I can't spot anything obviously wrong. Comment out pieces of your configuration to narrow things down. ---
**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Post date:** [May 9, 2017, 3:24pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103/3 "2017-05-09T15:24:22Z")
> [@Yaswanth](#): > > if [TOOK] \> 15ms { > mutate { > add\_tag =\> "slowresponse" > } > } else { > drop { } > } If i remove this part it is working fine. Is there any thing wrong in the above code? Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 4:30pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103/4 "2017-05-09T16:30:15Z")
Try: ``` if [TOOK] > "15ms" { ``` But! Keep in mind that this'll be a string comparison. If `TOOK` is "2ms" the expression above will be true. You should strip the "ms" suffix from `TOOK` and convert it to an integer. ---
**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Post date:** [May 9, 2017, 4:49pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103/5 "2017-05-09T16:49:29Z")
Thanks @magnusbaeck Still it is throwing the error ``` e[31mException in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#' for nil:NilClass>, "backtrace"=>["(eval):123:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):121:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):91:in `filter_func'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:267:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:265:in `filter_batch'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:223:in `worker_loop'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:201:in `start_workers'"], :level=>:error}e[0m NoMethodError: undefined method `>' for nil:NilClass initialize at (eval):123 each at org/jruby/RubyArray.java:1613 initialize at (eval):121 call at org/jruby/RubyProc.java:281 filter_func at (eval):91 filter_batch at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:267 each at org/jruby/RubyArray.java:1613 inject at org/jruby/RubyEnumerable.java:852 filter_batch at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:265 worker_loop at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:223 start_workers at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:201 ``` The matching grok pattern has output like this which means working fine ``` message" => "[2017-01-14 10:48:06,848][WARN][index.search.slowlog.query] [yaswanth] [bank][0] took[27.8ms], took_millis[27], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[], \r", "@version" => "1", "@timestamp" => "2017-05-09T16:43:58.995Z", "path" => "F:\\logstash-2.4.0\\logstash-2.4.0\\pica.txt", "host" => "yaswanth", "TIMESTAMP" => "2017-01-14 10:48:06,848", "LEVEL" => "WARN", "QUERY" => "index.search.slowlog.query", "QUERY1" => "yaswanth", "INDEX-NAME" => "bank", "SHARD" => "0", "TOOK" => "27.8ms", "TOOKM" => "27", "search_type" => "QUERY_THEN_FETCH", "total_shards" => "5" ``` Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 6:20pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103/6 "2017-05-09T18:20:38Z")
Are you sure _all_ events have a `TOOK` field? If you rewrite your conditional to ``` if [TOOK] and [TOOK] > "15ms" { ``` Logstash will only attempt the comparison if the `TOOK` field is set. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2017, 6:31pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103/7 "2017-06-06T18:31:57Z")
Closed on June 6, 2017, 6:31pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.