# Grok filter when logs format is not fixed

**URL:** https://discuss.elastic.co/t/grok-filter-when-logs-format-is-not-fixed/205408
**Category:** Logstash
**Created:** [October 28, 2019, 6:00am UTC](https://discuss.elastic.co/t/grok-filter-when-logs-format-is-not-fixed/205408 "2019-10-28T06:00:10Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![varunjithtk](https://avatars.discourse-cdn.com/v4/letter/v/c68b51/32.png) [@varunjithtk](https://discuss.elastic.co/u/varunjithtk)
#### Post date: [October 28, 2019, 6:00am UTC](https://discuss.elastic.co/t/grok-filter-when-logs-format-is-not-fixed/205408/1 "2019-10-28T06:00:10Z")

</div>

Am trying to parse the rest api request and response in my node logs. Below are two example logs  
{"level":"debug","message":"HTTP GET /1stexample/alerts/subs?userId=111","meta":{"res":{"statusCode":200},"req":{"headers":{"user-agent":"PostmanRuntime/1.1.1","accept":"_/_","cache-control":"no-cache","postman-token":"11111-5291-2222-b450-0d15579922206","accept-encoding":"gzip, deflate","via":"1.1 IDCFPCLUSTER 0A83490F ","host":"10.20.30.40:8888"}},"responseTime":59}}

{"level":"debug","message":"HTTP GET /2ndexample/alerts/subs?userId=111","meta":{"res":{"statusCode":200},"req":{"headers":"accept":"_/_","cache-control":"no-cache","postman-token":"11111-5291-2222-b450-0d15579922206","accept-encoding":"gzip, deflate","via":"1.1 IDCFPCLUSTER 0A83490F ","host":"10.20.30.40:8888"}},"responseTime":59}}

Am able to write a grok filter parse it and make sense out of it in kibana. But when there is a slight change in log , as shown in second log user-agent is missing, by grok parsing fails.

How to handle such cases?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 28, 2019, 7:57am UTC](https://discuss.elastic.co/t/grok-filter-when-logs-format-is-not-fixed/205408/2 "2019-10-28T07:57:44Z")

</div>

That looks like JSON, so use a JSON filter instead of grok.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 25, 2019, 7:57am UTC](https://discuss.elastic.co/t/grok-filter-when-logs-format-is-not-fixed/205408/3 "2019-11-25T07:57:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.