# Grok filter for log4j logs inorder to parse messages from logs

**URL:** <https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700>\
**Category:** Logstash\
**Created:** [January 24, 2017, 8:53pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700 "2017-01-24T20:53:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ritika](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@ritika](https://discuss.elastic.co/u/ritika)\
**Post date:** [January 24, 2017, 8:53pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700/1 "2017-01-24T20:53:28Z")

</div>

Hi,

I am completely new to ELK and installed ELK stack on my windows computer.  
My goal is to read and analyse log files (which are actually log4j files) sitting on different server.

I am able make logstash read my file in raw format and display it in kibana. But i need to parse the messages in the log files.  
For Example : my log looks like this

> 2017-01-24 15:00:11,471 [36] INFO UpToDate.Editorial.Service.Topic.IcgDataIslandSaveUtil [(null)] - Step 0, Start saving data island. 0.0010006 seconds since last step, 0.0020005 seconds since start.  
> 2017-01-24 15:00:11,489 [36] INFO UpToDate.Editorial.Service.Topic.TopicContentServiceImpl [(null)] - ad01q\sshyamde1 Save Data Island: \<?xml version="1.0" encoding="utf-8"?\>

I need to parse the message so that I can get the Loglevel , message and class name as a different entity.  
I tried to accomplish the same using Grok filter , but I get grok compile error.

Please help me if anybody can provide me the Grok filter that will give me what I want.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 24, 2017, 9:01pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700/2 "2017-01-24T21:01:53Z")

</div>

I think you'll find [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/) very useful for constructing your grok expression.

---

<div class="post-metadata">

**Author:** ![ritika](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@ritika](https://discuss.elastic.co/u/ritika)\
**Post date:** [January 25, 2017, 3:46pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700/3 "2017-01-25T15:46:39Z")

</div>

HI Magnus,

Thank you very much for your prompt reply, but before i go through the document , I want to know if I am on correct path.  
I mean is there any other way to parse Log4j messages other than asking developers to change their logging technique to json format.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 25, 2017, 6:59pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700/4 "2017-01-25T18:59:15Z")

</div>

> I mean is there any other way to parse Log4j messages other than asking developers to change their logging technique to json format.

JSON is definitely preferred, but plain text logs can be parsed too.

---

<div class="post-metadata">

**Author:** ![ritika](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@ritika](https://discuss.elastic.co/u/ritika)\
**Post date:** [January 25, 2017, 7:16pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700/5 "2017-01-25T19:16:35Z")

</div>

Thank you Magnus, I have now successfully made my grok filter.

Here is my grok filter created  
(%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND},%{NUMBER:line} [%{POSINT:pid}] %{LOGLEVEL:loglevel} %{GREEDYDATA:class} - %{GREEDYDATA:message}\n)

Pasting for in case if anybody would need it or find it helpful

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2017, 7:16pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700/6 "2017-02-22T19:16:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.