# Grok filter 2 different logs

**URL:** <https://discuss.elastic.co/t/grok-filter-2-different-logs/51818>\
**Category:** Logstash\
**Created:** [June 3, 2016, 6:05pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818 "2016-06-03T18:05:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [June 3, 2016, 6:05pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818/1 "2016-06-03T18:05:08Z")

</div>

Hi,  
I am trying to use the following grok filter to extract fields from log file, The log file contains 2 different style of logs, hence I wrote 2 different queries to tackle the 2 logs. However, it's failing on one of the logs..the one inside the if statement..i get "grokparsefailure error" Please help me.

filter {  
grok {  
match =\> ["message", "%{NOTSPACE}%{TIME}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE} %{WORD}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{WORD}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{NOTSPACE:requestDetails}"]

```
}
if[requestType] == "PROCESSING" {
	grok {
	match => ["message", "%{NOTSPACE}%{TIME}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{NOTSPACE}%{WORD}%{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE}%{SPACE}%{GREEDYDATA:requestDetails}"]
	}		
}
mutate {
    remove => ["message"]
}

```

}

The log file contents below  
2016-05-20 07:13:13 | INFO | [jmsContainer-10] | AQ-REQ | PROCESSING | FAILED FOR urn:gsma:imei:35774606-004713-0 I/O error on POST request for "[https://spp.msg.t-mobile.com:8083/pushnotification/v1.0/message](https://spp.msg.t-mobile.com:8083/pushnotification/v1.0/message)":Read timed out; nested exception is java.net.SocketTimeoutException: Read timed out  
2016-05-20 13:13:50 | INFO | [[ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'] | WAKEUP-REQ | RECEIVED | urn:gsma:imei:35774606-004713-0

---

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [June 3, 2016, 9:34pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818/2 "2016-06-03T21:34:48Z")

</div>

Can anybody please help me?

I am basically trying to apply grok filter to 2 different types of log structures as shown below  
2016-06-03 08:45:02 | INFO | [jmsContainer-15] | AQ-REQ | PROCESSING | SUCCESS FOR urn:uuid:64543F49-6A27-4AD9-AC0D-0B0A0AA27936

2016-05-20 04:06:12 | INFO | [[ACTIVE] ExecuteThread: '8' for queue: 'weblogic.kernel.Default (self-tuning)'] | WAKEUP-REQ | SUCCESS | urn:gsma:imei:35774606-004713-0 - 200 - - {"statusCode":"success","statusMessage":"Wakeup request recieved"}

what I have is this:

filter {  
grok {  
match =\> ["message", "%{NOTSPACE} %{NOTSPACE:threadType} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}"]

```
}
if[threadType] == "[[ACTIVE]" {
	grok {
	match => ["message", "%{NOTSPACE} %{NOTSPACE:threadType} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE:requestType} %{NOTSPACE} %{NOTSPACE:requestStatus} %{NOTSPACE} %{GREEDYDATA:requestDetails}"]
	}		
}
mutate {
    remove => ["message"]
}

```

}

I get the following when I run logstash..the fields are giving me similar output...

 ![](https://us1.discourse-cdn.com/elastic/original/2X/7/76191e01dcf7937f956eaa3c30a9fb6772199519.PNG)

---

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [June 6, 2016, 6:20pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818/3 "2016-06-06T18:20:17Z")

</div>

help. still stuck

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 8, 2016, 6:23pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818/4 "2016-06-08T18:23:03Z")

</div>

Those grok expressions are unreadable. Why don't you use the csv filter instead?

---

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [June 8, 2016, 6:37pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818/5 "2016-06-08T18:37:02Z")

</div>

How do you use csv filter?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 9, 2016, 8:00pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818/6 "2016-06-09T20:00:58Z")

</div>

Have you looked at the documentation or googled for examples?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818/7 "2017-07-06T04:53:52Z")

</div>