# Grok filter with file input

**URL:** <https://discuss.elastic.co/t/grok-filter-with-file-input/150348>\
**Category:** Logstash\
**Created:** [September 28, 2018, 1:17pm UTC](https://discuss.elastic.co/t/grok-filter-with-file-input/150348 "2018-09-28T13:17:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![M.alsioufi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m.alsioufi/32/52269_2.png) [@M.alsioufi](https://discuss.elastic.co/u/M.alsioufi)\
**Post date:** [September 28, 2018, 1:17pm UTC](https://discuss.elastic.co/t/grok-filter-with-file-input/150348/1 "2018-09-28T13:17:45Z")

</div>

Hi  
I have set of logs that are generated to .log files, and I want to index them in Elasticsearch using Logstash.  
The log file contains many lines each line looks like the following:

2018-09-26 17:05:34,060 INFO: ProcessName: ProcessX, File: XFile.txt

How can I insert this to an Elasticsearch index using file plugin for Logstash:  
{  
timestamp: 2018-09-26 17:05:34,060,  
level: "INFO",  
process\_name: "ProcessX",  
File: "XFile.txt"  
}

---

<div class="post-metadata">

**Author:** ![M.alsioufi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m.alsioufi/32/52269_2.png) [@M.alsioufi](https://discuss.elastic.co/u/M.alsioufi)\
**Post date:** [September 28, 2018, 1:29pm UTC](https://discuss.elastic.co/t/grok-filter-with-file-input/150348/2 "2018-09-28T13:29:53Z")

</div>

I found the solution finally!  
%{DATESTAMP:timestamp} %{GREEDYDATA:level}: Process: %{GREEDYDATA:process}, File: %{GREEDYDATA:file\_name}\r

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [September 28, 2018, 2:26pm UTC](https://discuss.elastic.co/t/grok-filter-with-file-input/150348/3 "2018-09-28T14:26:40Z")

</div>

Try not to use GREEDYDATA so much as it's very expensive and can cause performance problems.  
Try using patterns like NOTSPACE or WORD instead.  
Be sure to use the grokdebugger to help you figure out the easiest method:

[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

Try this:  
`%{DATESTAMP:timestamp} %{WORD:Level}: ProcessName: %{WORD:ProcessName}, File: %{JAVAFILE:Filename}`

---

<div class="post-metadata">

**Author:** ![M.alsioufi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m.alsioufi/32/52269_2.png) [@M.alsioufi](https://discuss.elastic.co/u/M.alsioufi)\
**Post date:** [September 28, 2018, 2:31pm UTC](https://discuss.elastic.co/t/grok-filter-with-file-input/150348/4 "2018-09-28T14:31:52Z")

</div>

> [@AquaX](#):
>
> %{DATESTAMP:timestamp} %{WORD:Level}: ProcessName: %{WORD:ProcessName}, File: %{JAVAFILE:Filename}

Thank you, for the advice!  
This is seems to be working, but I have one problem my actual file field is a path to the file like:  
"C:\path\to\file.txt"  
is there any pattern to handle the path ?

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [October 3, 2018, 8:17pm UTC](https://discuss.elastic.co/t/grok-filter-with-file-input/150348/5 "2018-10-03T20:17:59Z")

</div>

Yep! It's called %{WINPATH}

🙂

You can find all the patterns here:  
[https://grokdebug.herokuapp.com/patterns#](https://grokdebug.herokuapp.com/patterns#)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2018, 8:18pm UTC](https://discuss.elastic.co/t/grok-filter-with-file-input/150348/6 "2018-10-31T20:18:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.