# Getting started with ELK catalina.out login
**URL:** https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077
**Category:** Elasticsearch
**Created:** [May 26, 2016, 3:49pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077 "2016-05-26T15:49:18Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@CValor](https://discuss.elastic.co/u/CValor)
#### Post date: [May 26, 2016, 3:49pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/1 "2016-05-26T15:49:18Z")
Hey there, i'm getting started with elk solution my catalina.out is login in the follow format:
"Mar 23, 2016 11:33:14 AM" .
I parse the log using grok as follow
%{MONTH} +%{MONTHDAY}, %{YEAR} %{TIME} %{WORD} %{JAVACLASS} %{WORD:message}\n%{LOGLEVEL:loglevel}: %{DATA}\n%{DATA}\n
Now i'm creating a index on elastic with mapping like this:
"mappings" : {
"_default_" : {
"properties" : {
"timestamp": {
"type": "date",
"format": "MMM dd, YYYY hh:mm:ss"
},
"JavaClass": {
"type": "string","index":"not\_analyzed"
},
"methodName":{
"type":"string","index":"not\_analyzed"
},
"message": {
"type": "string"
},
"loglevel": {
"type": "string"
},
"extradata": {
"type": "string"
}
}
}
}
But in kibana i have the follow message
"Discover: An error occurred with your request. Reset your inputs and try again."
I'm missing something?
If anyone is able to assist me please let me know
Thank's,
Cristian
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 26, 2016, 10:41pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/2 "2016-05-26T22:41:33Z")
Is there anything else in the KB logs themselves?
---
### Author:  [@CValor](https://discuss.elastic.co/u/CValor)
#### Post date: [May 26, 2016, 10:57pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/3 "2016-05-26T22:57:20Z")
Thank for the replay
Yes it's i'm close to solve this. There is a way to say to grok take everything esle for that event and parse as GREEDYDATA for example?
Thanks again,
Cristian
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 29, 2016, 10:33am UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/4 "2016-05-29T10:33:23Z")
> Yes it's i'm close to solve this. There is a way to say to grok take everything esle for that event and parse as GREEDYDATA for example?
Yes, just put `%{GREEDYDATA:whatever}` to have it capture as much as it can. Without specifics of what you're trying to do it's impossible to be specific.
---
### Author:  [@CValor](https://discuss.elastic.co/u/CValor)
#### Post date: [May 31, 2016, 7:26pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/5 "2016-05-31T19:26:38Z")
Thanks for replay Magnus,
I have a log like this:
May 19, 2016 7:15:42 PM com.sun.xml.ws.transport.http.HttpAdapter fixQuotesAroundSoapAction
INFO: Received WS-I BP non-conformant Unquoted SoapAction HTTP header:
sendResponseStatus 530 SPA not supported by the object
java.lang.Throwable
When i try the grok debug all work just fine but when i execute the same code in logstash i have a grokparsefailure.
Im using the following custom pattern
CATALINA\_DATESTAMP %{MONTH} %{MONTHDAY}, 20%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?:AM|PM)
CATALINALOG %{CATALINA\_DATESTAMP:timestamp} %{JAVACLASS:class} %{JAVALOGMESSAGE}\c\n%{LOGLEVEL: logLevel}:
JAVALOGMESSAGE (.\*)
When i was testing that in logstash i realize that the \n or \c\n is not working in my logstash. Any suggestions? I have installed Logstash 2.3.1 All Plugins
Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 31, 2016, 7:31pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/6 "2016-05-31T19:31:03Z")
Have you used the multiline codec to join the lines of the log so that the text you're actually parsing contains the whole message? Please use a `stdout { codec => rubydebug }` output to debug this matter, and show the output of that so that we can see exactly what happens.
---
### Author:  [@CValor](https://discuss.elastic.co/u/CValor)
#### Post date: [May 31, 2016, 7:40pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/7 "2016-05-31T19:40:11Z")
Yes i did. Here is my whole filter
```
grok {
match => ["message", "%{CATALINALOG}"]
```
}
multiline {
pattern =\> "(^%{CATALINA\_DATESTAMP})"
negate =\> true
what =\> "previous"
}
}
I'm testing that like you saying already, that's my output:
```
"message" => "May 19, 2016 7:15:42 PM com.sun.xml.ws.transport.http.HttpAdapter fixQuotesAroundSoapAction\nINFO: Received WS-I BP non-conformant Unquoted SoapAction HTTP header: \nsendResponseStatus 530 SPA not supported by the object",
"@version" => "1",
"@timestamp" => "2016-05-31T19:29:15.765Z",
"host" => "FBDtest",
"tags" => [
[0] "_grokparsefailure",
[1] "multiline"
]
```
}
I saw a lot of examples doing the same but seems i'm the only one who have that problem 😓
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 31, 2016, 8:33pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/8 "2016-05-31T20:33:01Z")
Start by establishing what part of your expression that doesn't match. Start with the simplest possible expression, `%{MONTH}` in your case, and add token after token until it stops working.
What's up with the \c? I don't believe that's a standard escape sequence, and it's obviously not part of your message.
---
### Author:  [@CValor](https://discuss.elastic.co/u/CValor)
#### Post date: [May 31, 2016, 8:41pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/9 "2016-05-31T20:41:58Z")
I already know which part don't match but that only happens on logstash.
I already try skiping the \c\n%{LOGLEVEL: logLevel}: part and it work fine
and even try with just \n%{LOGLEVEL: logLevel}:
Same output
In the grok debugger work in both cases but not in my logstash. We are going anywhere here, thanks for reply's i'll keep trying to solve that.
Regards,
Cristian
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:47pm UTC](https://discuss.elastic.co/t/getting-started-with-elk-catalina-out-login/51077/10 "2017-07-05T22:47:30Z")