# GROK Filter failing to parse loglevel, RequestUUID fields with Logstash 2.0.5 and Grok 2

**URL:** <https://discuss.elastic.co/t/grok-filter-failing-to-parse-loglevel-requestuuid-fields-with-logstash-2-0-5-and-grok-2/155808>\
**Category:** Logstash\
**Created:** [November 8, 2018, 2:00am UTC](https://discuss.elastic.co/t/grok-filter-failing-to-parse-loglevel-requestuuid-fields-with-logstash-2-0-5-and-grok-2/155808 "2018-11-08T02:00:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![palmeti](https://avatars.discourse-cdn.com/v4/letter/p/71c47a/32.png) [@palmeti](https://discuss.elastic.co/u/palmeti)\
**Post date:** [November 8, 2018, 2:00am UTC](https://discuss.elastic.co/t/grok-filter-failing-to-parse-loglevel-requestuuid-fields-with-logstash-2-0-5-and-grok-2/155808/1 "2018-11-08T02:00:02Z")

</div>

Log4net log

2018-11-07 19:55:06,848 DEBUG CXYZ [47] 0HLI4IVM5VCGV:00000013 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker: Resource Filter: Before executing OnResourceExecuted on filter Microsoft.AspNetCore.Mvc.ConsumesAttribute.

GROK filter  
^%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}?%{SPACE}?%{IPORHOST:tempHost}%{SPACE}[%{INT:thread}%{SPACE}]%{SPACE}%{NOTSPACE:requestUUID}[^:]\*%{SPACE}%{DATA:logger}:%{SPACE}%{GREEDYDATA:tempMessage}

Above filter works on Grok Debugger tool but on our server which has Logstash 2.0.5 and Grok 2

Any help would be appreciated to resolve loglevel, RequestUUID

Expected Result  
{  
"timestamp": [  
[  
"2018-11-07 19:55:06,848"  
]  
],  
"YEAR": [  
[  
"2018"  
]  
],  
"MONTHNUM": [  
[  
"11"  
]  
],  
"MONTHDAY": [  
[  
"07"  
]  
],  
"HOUR": [  
[  
"19",  
null  
]  
],  
"MINUTE": [  
[  
"55",  
null  
]  
],  
"SECOND": [  
[  
"06,848"  
]  
],  
"ISO8601\_TIMEZONE": [  
[  
null  
]  
],  
"SPACE": [  
[  
" ",  
" ",  
"",  
" ",  
"",  
" ",  
"",  
" "  
]  
],  
"loglevel": [  
[  
"DEBUG"  
]  
],  
"tempHost": [  
[  
"CXYZ"  
]  
],  
"HOSTNAME": [  
[  
"CXYZ"  
]  
],  
"IP": [  
[  
null  
]  
],  
"IPV6": [  
[  
null  
]  
],  
"IPV4": [  
[  
null  
]  
],  
"thread": [  
[  
"47"  
]  
],  
"requestUUID": [  
[  
"0HLI4IVM5VCGV:00000013"  
]  
],  
"logger": [  
[  
""  
]  
],  
"tempMessage": [  
[  
"Resource Filter: Before executing OnResourceExecuted on filter Microsoft.AspNetCore.Mvc.ConsumesAttribute."  
]  
]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2018, 2:14am UTC](https://discuss.elastic.co/t/grok-filter-failing-to-parse-loglevel-requestuuid-fields-with-logstash-2-0-5-and-grok-2/155808/2 "2018-12-06T02:14:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.