# Grok filter issue with data on Logstah config

**URL:** <https://discuss.elastic.co/t/grok-filter-issue-with-data-on-logstah-config/180337>\
**Category:** Logstash\
**Created:** [May 9, 2019, 10:46am UTC](https://discuss.elastic.co/t/grok-filter-issue-with-data-on-logstah-config/180337 "2019-05-09T10:46:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [May 9, 2019, 10:46am UTC](https://discuss.elastic.co/t/grok-filter-issue-with-data-on-logstah-config/180337/1 "2019-05-09T10:46:58Z")

</div>

Hi Team,  
I am facing issue while using grok filter pattern for our log:  
here is my log message:  
2019-05-09 08:18:41.6499|INFO|Processor|8552|5825|Content|Calling for job id 5776, logid 17586

LogStash.config :

input {  
beats {  
port =\> 5044  
}  
}  
filter {

mutate {  
add\_field =\> { "[@metadata][index]" =\> "%{[fields][type]}" }  
}

```
	if [@metadata][index] == "imagelog"{

```

grok {  
match =\> ["message","(?(([0-9]+)-_)+ ([0-9]+:_)+.\*)|%{WORD:LOGLEVEL}|%{WORD:LOGSOURCE}|%{NUMBER:Id}|%{NUMBER:FileId}|%{DATA:Name}|%{GREEDYDATA:LOGMESSAGE}"]  
}  
}

```
	else
{

grok {
        match => ["message","(?<DATETIME>(([0-9]+)-*)+ ([0-9]+:*)+.*)\|%{WORD:LOGLEVEL}\|%{WORD:LOGSOURCE}\|%{GREEDYDATA:LOGMESSAGE}"]
	}
	
}
	
}

```

In my case else condition working fine, but if condition not return required result  
it return below result on kibana:  
DATETIME field return: 2019-05-09 08:18:41.6499, 2019-05-09 08:18:41.6499|INFO|Processor|8552  
LOGLEVEL field return: INFO, 5825  
In LOGLEVEL I just want to return only INFO as per the logmessage.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 9, 2019, 3:14pm UTC](https://discuss.elastic.co/t/grok-filter-issue-with-data-on-logstah-config/180337/2 "2019-05-09T15:14:02Z")

</div>

If you have a message in which the fields are delimited I would recommend using dissect rather than grok.

```
dissect { mapping => { "message" => "%{ts}|%{loglevel}|%{logsource}|%{id}|%{fileid}|%{name}|%{message}" } }

```

If the entire set of events is pipe delimited you could also consider using a csv filter.

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [May 10, 2019, 6:24pm UTC](https://discuss.elastic.co/t/grok-filter-issue-with-data-on-logstah-config/180337/3 "2019-05-10T18:24:19Z")

</div>

Thanks Badger,  
Today its working fine without any changes.  
I'll try with dissect filter also for better performance.

{ts} stand for timestamp?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 10, 2019, 7:50pm UTC](https://discuss.elastic.co/t/grok-filter-issue-with-data-on-logstah-config/180337/4 "2019-05-10T19:50:12Z")

</div>

> [@Sharma3007](#):
>
> {ts} stand for timestamp?

Yes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2019, 7:50pm UTC](https://discuss.elastic.co/t/grok-filter-issue-with-data-on-logstah-config/180337/5 "2019-06-07T19:50:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.