]`
But I am sorry!It is hard to me to debug!If it is wrong ,the logstash log just tell me `,"_grokparsefailure","_dateparsefailure"`. I don't know what went wrong!
Although you tell me I should split three sections,I don't know how to split it to three sections.I just know to match filed one by one!
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [September 27, 2018, 4:31pm UTC](https://discuss.elastic.co/t/grok-cant-match-my-log/149920/4 "2018-09-27T16:31:33Z")
Ok, don't fret, I'll help - these next steps are hard.
Here is a working example:
```auto
input {
generator {
lines => [
'[23:59:52.743]2018-08-14 23:59:52 DEBUG [resin-tcp-connection-*:8012-59] /queryup[sversion=5][model=HUAWEI G7-UL20][from=_360][lastupdatetime=1532506757000][versioncode=201805140][userId=13994251][mac=863846027484619][version=5.2.7][uniqid=974846027484619][needsecretary=true][os=Android4.4.4][screen=720,1184][token=8737a7830aa0c5a14633abd300187af1][appid=1][agent=testBizCard/5.2.7][ip=113.231.11.12][session=abcsZQsuoJfY-6xkJk5uw] [com.test.mobile.interceptor.LoggerInterceptor.before(63)]'
]
count => 1
}
}
filter {
grok {
match => {
"message" => [
'^\[%{TIME:time}\]%{TIMESTAMP_ISO8601:date_time} %{LOGLEVEL:level} %{NOTSPACE} %{URIPATH:uripath}\[%{DATA:kv_section}\] \[%{DATA:tail_section}\]$'
]
}
}
kv {
source => "kv_section"
# value split defaults to '='
field_split => "\]\["
remove_field => ["message", "kv_section"]
}
mutate {
gsub => ["[date_time]", "\s\S+$", "T%{[time]}Z"]
}
date {
match => ["date_time", "ISO8601"]
remove_field => ["time", "date_time"]
}
}
output {
stdout {
codec => rubydebug
}
}
```
Result:
```auto
{
"host" => "Elastics-MacBook-Pro.local",
"level" => "DEBUG",
"os" => "Android4.4.4",
"session" => "abcsZQsuoJfY-6xkJk5uw",
"uripath" => "/queryup",
"appid" => "1",
"from" => "_360",
"lastupdatetime" => "1532506757000",
"mac" => "863846027484619",
"model" => "HUAWEI G7-UL20",
"agent" => "testBizCard/5.2.7",
"@version" => "1",
"@timestamp" => 2018-08-14T23:59:52.743Z,
"uniqid" => "974846027484619",
"screen" => "720,1184",
"ip" => "113.231.11.12",
"version" => "5.2.7",
"tail_section" => "com.test.mobile.interceptor.LoggerInterceptor.before(63)",
"token" => "8737a7830aa0c5a14633abd300187af1",
"sequence" => 0,
"needsecretary" => "true",
"sversion" => "5",
"versioncode" => "201805140",
"userId" => "13994251"
}
```
Hope this helps.
---
### Author:  [@Haitianisgood](https://discuss.elastic.co/u/Haitianisgood)
#### Post date: [September 28, 2018, 7:26am UTC](https://discuss.elastic.co/t/grok-cant-match-my-log/149920/5 "2018-09-28T07:26:58Z")
Thank you very much for your reply!
I had solved my question as your advice yesterday!
My solution:
```auto
filter {
if [type] == "test" {
grok {
match => [
"message" => "\[%{TIME:time}\](20%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR}:%{MINUTE}:%{SECOND}) %{LOGLEVEL:level} %{NOTSPACE} %{URIPATH:uripath}"
]
}
if [level] == "DEBUG" {
kv {
value_split => "="
field_split => "\[\]"
}
}
mutate {
add_field => ["test_time","20%{year}-%{month}-%{day} %{time}"]
}
date {
match => ["test_time","yyyy-MM-dd HH:mm:ss.SSS"]
}
prune {
whitelist_names => ["^@timestamp$","^type$","^model$","^host$","^agent$","^version$","^path$","^uripath$","^message$","^@version$","^userId$","^level$","^os$","^from$","^ip$"]
}
}
}
```
I think your example is better than mine.
I still want to how to debug when it report `"_grokparsefailure","_dateparsefailure"`? What went wrong?
At the last thank you very much again!
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [September 28, 2018, 1:21pm UTC](https://discuss.elastic.co/t/grok-cant-match-my-log/149920/6 "2018-09-28T13:21:00Z")
For grok and date parse failure debugging, I advise using the generator input, one grok or date and the stdout+rubydebug config. Start simple and work from left to right. The generator input string can be part of the text or all of it. If you use part of it start from the left and concatenate logical sections from the original line.
For regular expressions I test with [https://regex101.com/](https://regex101.com/)
Lastly. the kv filter has a settings to include or exclude fields so you may not need the prune filter. `@timestamp` is not a required field but if you use date/time based indexes in the ES output, you will get errors if the `@timestamp` field is missing.
---
### Author:  [@Haitianisgood](https://discuss.elastic.co/u/Haitianisgood)
#### Post date: [September 29, 2018, 3:49am UTC](https://discuss.elastic.co/t/grok-cant-match-my-log/149920/7 "2018-09-29T03:49:54Z")
Thank you very much for your help!!!
I will try as your advice.
Thank you very much again!!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 27, 2018, 3:49am UTC](https://discuss.elastic.co/t/grok-cant-match-my-log/149920/8 "2018-10-27T03:49:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.