# Grok filter for application logs

**URL:** <https://discuss.elastic.co/t/grok-filter-for-application-logs/119479>\
**Category:** Logstash\
**Created:** [February 12, 2018, 2:10pm UTC](https://discuss.elastic.co/t/grok-filter-for-application-logs/119479 "2018-02-12T14:10:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\
**Post date:** [February 12, 2018, 2:10pm UTC](https://discuss.elastic.co/t/grok-filter-for-application-logs/119479/1 "2018-02-12T14:10:04Z")

</div>

Hi all,

I have a problem in reading the below logs

## log file 1

router#001(26322) 2018/02/09 00:00:17 -FKSPT- {2:2} Read from MQMNGR1P2:TSS\_MTHIGH\_WMQ\_IN[wmqin(srid)] \<Message(candidate =\> unknown, id =\> (2)"-1", userref =\> (13)"1830300016.01", reference =\> (12)"MM1801506848", relatedref =\> (16)"TATAL2L0000SCBL2L", message\_id =\> (20)"20180209MM1801506848", system\_id =\> (29)"MTH20180209000017-24761-26322")\>

## log file 2

router#002(99253) 2018/02/09 00:00:17 -FKSPT- {2:2} Write on MQMNGR1P2:TSS\_MTHIGH\_WMQ\_ACK[wmqout] \<Message(candidate =\> unknown, id =\> (2)"-1", userref =\> (13)"1830300016.01", reference =\> (12)"MM1801506848", relatedref =\> (16)"TATAL2L0000SCBL2L", message\_id =\> (20)"20180209MM1801506848", system\_id =\> (29)"MTH20180209000017-24761-26322")\>

from file 1, I want to create a field as "intime" and capture 2018/02/09 00:00:17 and "messageID" and capture the word "20180209MM1801506848"

from file 2, I want to create a field as "outtime" and capture 2018/02/09 00:00:17and "messageID" and capture the word "20180209MM1801506848"

Please help me on the filterting..!!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2018, 2:10pm UTC](https://discuss.elastic.co/t/grok-filter-for-application-logs/119479/2 "2018-03-12T14:10:45Z")

</div>

Closed on March 12, 2018, 2:10pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.