# Grok Filter for JIRA Access Logs

**URL:** <https://discuss.elastic.co/t/grok-filter-for-jira-access-logs/124545>\
**Category:** Logstash\
**Created:** [March 19, 2018, 11:46am UTC](https://discuss.elastic.co/t/grok-filter-for-jira-access-logs/124545 "2018-03-19T11:46:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![deepesh\_goel](https://avatars.discourse-cdn.com/v4/letter/d/e68b1a/32.png) [@deepesh\_goel](https://discuss.elastic.co/u/deepesh_goel)\
**Post date:** [March 19, 2018, 11:46am UTC](https://discuss.elastic.co/t/grok-filter-for-jira-access-logs/124545/1 "2018-03-19T11:46:10Z")

</div>

Hi Everyone,

Lately I been working on JIRA access logs parsing using grok filter but did not able to write a one.

Can anyone help me on writing a grok filter for my JIRA access logs.

Example:  
10.12.68.155 0x14430011x2 B0095757 [15/Mar/2018:00:00:08 +0530] "GET /jira/rest/greenhopper/1.0/xboard/issue/details.json?rapidViewId=364&issueIdOrKey=DT-3204&loadSubtasks=true&_=1521052210613 HTTP/1.1" 200 9670 219 "[http://10.5.200.224:8080/jira/secure/RapidBoard.jspa?rapidView=364&projectKey=DT&view=planning&selectedIssue=DT-3204](http://10.5.200.224:8080/jira/secure/RapidBoard.jspa?rapidView=364&projectKey=DT&view=planning&selectedIssue=DT-3204)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_10\_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36" "u1kpw4"  
10.12.68.155 0x14430013x3 B0095757 [15/Mar/2018:00:00:08 +0530] "GET /jira/rest/tempo-rest/2.0/gh/canOnlyViewOwnWorklogs/254122?_=1521052211001 HTTP/1.1" 200 46 4 "[http://10.5.200.224:8080/jira/secure/RapidBoard.jspa?rapidView=364&projectKey=DT&view=planning&selectedIssue=DT-3204](http://10.5.200.224:8080/jira/secure/RapidBoard.jspa?rapidView=364&projectKey=DT&view=planning&selectedIssue=DT-3204)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_10\_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36" "u1kpw4"  
10.12.68.155 0x14430012x2 B0095757 [15/Mar/2018:00:00:08 +0530] "POST /jira/plugins/servlet/kintosoft/tree/dwr/call/plaincall/LinksDWRService.getIssueChildren.dwr HTTP/1.1" 200 838 35 "[http://10.5.200.224:8080/jira/secure/RapidBoard.jspa?rapidView=364&projectKey=DT&view=planning&selectedIssue=DT-3204](http://10.5.200.224:8080/jira/secure/RapidBoard.jspa?rapidView=364&projectKey=DT&view=planning&selectedIssue=DT-3204)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_10\_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36" "u1kpw4"

I have to filter the ip, id(B0095757 ) and timestamp. The grok filter which is wrote is:

grok {  
match =\> { "message" =\> "%{IPV4:clientip} (?:._) (?[0-9A-F]{8}) [%{HTTPDATE:accesstime}] (?:._) " }  
remove\_field =\> "message"  
}  
Kindly Help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2018, 11:46am UTC](https://discuss.elastic.co/t/grok-filter-for-jira-access-logs/124545/2 "2018-04-16T11:46:22Z")

</div>

Closed on April 16, 2018, 11:46am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.