# Grock filter

**URL:** <https://discuss.elastic.co/t/grock-filter/218308>\
**Category:** Logstash\
**Created:** [February 7, 2020, 9:50am UTC](https://discuss.elastic.co/t/grock-filter/218308 "2020-02-07T09:50:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kau0826](https://avatars.discourse-cdn.com/v4/letter/k/4af34b/32.png) [@kau0826](https://discuss.elastic.co/u/kau0826)\
**Post date:** [February 7, 2020, 9:50am UTC](https://discuss.elastic.co/t/grock-filter/218308/1 "2020-02-07T09:50:57Z")

</div>

Hi Team,  
I have a logs as below and its currently view in kinaba, but i need to get logs from start and end point. as a example in below logs i need to get logs between "API CALL" to "API CALL END" in kibana. could you please help to create a grock filter for this.

logs ---

============================== API CALL [ad6ee9e98e83b45e34f586f68784208c] ============================

URL: [https://contentapis-qa.BTcms.net/assessment-api/assessment/v2/urn:BT:work:](https://contentapis-qa.BTcms.net/assessment-api/assessment/v2/urn:BT:work:)

Request Payload:  
""

Request Header:  
["Content-Type:application/json","BTSSOSession:-dnekrOJgh9D78n-D60gexCggVo._AAJTSQACMDIAAlNLAB5Yk5OcVB5WEFFa2dJeExJT0E9AAR0eXBlAANDVFMAAlMxAAIwNw.._","ApiKey:61h40NbINElGHC9fC6A5ZIA7","Correlation-Id:QUADD-b8aa9b4c-9179-45ae-9f83-cd0e516a2020"]

Response:  
HTTP/1.1 400 Bad Request  
Date: Thu, 06 Feb 2020 15:21:11 GMT  
Content-Type: application/problem+json;charset=UTF-8  
Transfer-Encoding: chunked  
Connection: keep-alive  
Server: openresty/1.13.6.2  
Cache-Control: no-store, no-cache, mustrevalidate, max-age=0  
Pragma: no-cache  
X-XSS-Protection: 1; mode=block  
X-ContentType-Options: nosniff  
Access-Control-Allow-Credentials: true  
Access-Control-Allow-Headers: Prefer,x-authorization,If-Match,x-apikey,apikey,X-BTSSOSession,BTSSOSession,Correlation-id,X-Roles,X-Roles-Test,Authorization,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type  
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH  
Access-Control-Expose-Headers: contentdb-URN, contentdb-UUID, Link, Location, ETag

{"detail":"getAssessment.versionUrn: should be in format urn:BT:work:","status":400}

CURL Info: {"url":"[https://contentapis-qa.BTcms.net/assessment-api/assessment/v2/urn:BT:work:","content\_type":"application/problem+json;charset=UTF-8","http\_code":400,"header\_size":814,"request\_size":378,"filetime":-1,"ssl\_verify\_result":0,"redirect\_cou](https://contentapis-qa.BTcms.net/assessment-api/assessment/v2/urn:BT:work:%22,%22content_type%22:%22application/problem+json;charset=UTF-8%22,%22http_code%22:400,%22header_size%22:814,%22request_size%22:378,%22filetime%22:-1,%22ssl_verify_result%22:0,%22redirect_cou)  
nt":0,"total\_time":0.013434,"namelookup\_time":2.0000000000000002e-5,"connect\_time":0.0014270000000000001,"pretransfer\_time":0.0091660000000000005,"size\_upload":0,"size\_download":96,"speed\_download":7384,"speed\_upload":0,"download\_content\_length":-1,"upload\_content\_lengt  
h":-1,"starttransfer\_time":0.013406,"redirect\_time":0,"redirect\_url":"","primary\_ip":"152.10.85.25","certinfo":,"primary\_port":443,"local\_ip":"10.10.10.45","local\_port":59832}

Total time elapsed: 0.013434 second(s)

============================== API CALL END ============================

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2020, 9:51am UTC](https://discuss.elastic.co/t/grock-filter/218308/2 "2020-03-06T09:51:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.