# Grok Filter Parsing Logs

**URL:** <https://discuss.elastic.co/t/grok-filter-parsing-logs/160777>\
**Category:** Logstash\
**Created:** [December 13, 2018, 4:36pm UTC](https://discuss.elastic.co/t/grok-filter-parsing-logs/160777 "2018-12-13T16:36:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul1243](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@paul1243](https://discuss.elastic.co/u/paul1243)\
**Post date:** [December 13, 2018, 4:36pm UTC](https://discuss.elastic.co/t/grok-filter-parsing-logs/160777/1 "2018-12-13T16:36:57Z")

</div>

Hi-  
I have the unstructured logs receiving using the tcp input in Logstash:

```auto
"win_cpu,host=Test-Machine-01,instance=UCMS,objectname=Process Percent_User_Time=0,Percent_Privileged_Time=0 1544716850000000000\n",

```

I would want to use Grok Filter and parse the above data which is coming in the message field and send it to ES as below:

{  
hostname: Test-Machine-01,  
process\_name: UCMS,  
Percent\_User\_Time=0,  
Percent\_Privileged\_Time=0  
}

Is it really achievable using Grok Filter ? Please let me know. Thanks !

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [December 16, 2018, 1:13am UTC](https://discuss.elastic.co/t/grok-filter-parsing-logs/160777/2 "2018-12-16T01:13:42Z")

</div>

For sure it’s possible!  
You can use this tool to help you create the pattern:  
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

Your output almost looks like an InfluxDB line protocol from Telegraf. You should look into metrics beat to gather the same type of information.

---

<div class="post-metadata">

**Author:** ![paul1243](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@paul1243](https://discuss.elastic.co/u/paul1243)\
**Post date:** [December 16, 2018, 5:19am UTC](https://discuss.elastic.co/t/grok-filter-parsing-logs/160777/3 "2018-12-16T05:19:38Z")

</div>

@AquaX - Yes, output is from Telegraf, I have used metricbeats windows module to collect perfmon data, but I noticed it returns some unreal values for couple of counters, which I couldn't able to figure it out is something wrong with the beats or from the server end, so was just trying with telegraf to cross-check.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2019, 5:19am UTC](https://discuss.elastic.co/t/grok-filter-parsing-logs/160777/4 "2019-01-13T05:19:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.