# Grok by beats agent

**URL:** <https://discuss.elastic.co/t/grok-by-beats-agent/264008>\
**Category:** Logstash\
**Created:** [February 11, 2021, 11:28am UTC](https://discuss.elastic.co/t/grok-by-beats-agent/264008 "2021-02-11T11:28:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hugoboubou](https://avatars.discourse-cdn.com/v4/letter/h/ac8455/32.png) [@hugoboubou](https://discuss.elastic.co/u/hugoboubou)\
**Post date:** [February 11, 2021, 11:28am UTC](https://discuss.elastic.co/t/grok-by-beats-agent/264008/1 "2021-02-11T11:28:43Z")

</div>

Hello 😃

I have several beats entries on my logstash, but the logs I process are different, so I would like to do a grok by beat.

example log lines :

2017/07/27 18:02:37 VCS ERROR V-16-1-54031 Resource XXXXXXXXX(Owner: Unspecified, Group: XXXXXXXXX) is FAULTED on sys rsxl010101

for this log, i have this grok :  
match =\> { "message" =\> "%{DATESTAMP:mytimestamp} %{WORD:tp} %{LOGLEVEL:logLevel} %{GREEDYDATA:logMessage}" }  
that's ok. It can work on %{LOGLEVEL:logLevel} in kibana with filters.

But filebeat catch another file with this line :  
02/11/2021 03:21:54 ANS0361I DIAG: sessSendVerb: Error sending Verb, rc: -50

My previous grok don't understand that "ANS0361I" is an %{WORD:tp}  
I can't make filters on tp is ANS0361I

Do you have any advices ? 🙂

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 11, 2021, 12:38pm UTC](https://discuss.elastic.co/t/grok-by-beats-agent/264008/2 "2021-02-11T12:38:04Z")

</div>

The problem is not with the string `ANS0361I`, the pattern `WORD` can match it without any problem, but after that grok will try to match `DIAG` using the pattern `LOGLEVEL`, which will not work because it is not a log level, so you will get an `_grokparsefailure` error.

Your messages are completely different, the timestamp is different, the format of the messages is different, it is better to create another grok expression to match this second format.

---

<div class="post-metadata">

**Author:** ![hugoboubou](https://avatars.discourse-cdn.com/v4/letter/h/ac8455/32.png) [@hugoboubou](https://discuss.elastic.co/u/hugoboubou)\
**Post date:** [February 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/grok-by-beats-agent/264008/3 "2021-02-11T14:12:27Z")

</div>

thank you for your reply,

Now, i have two different grok expression, one for the first file and another for the second file.

How i can say in logstash : "this grok expression is for the files /etc/var/log/messages/\*.log (for example) and this pattern is for /etc/var/log/urgent/gc.log" ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2021, 2:13pm UTC](https://discuss.elastic.co/t/grok-by-beats-agent/264008/4 "2021-03-11T14:13:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.