# Grok filter **URL:** \ **Category:** Logstash\ **Created:** [May 11, 2017, 3:59pm UTC](https://discuss.elastic.co/t/grok-filter/85444 "2017-05-11T15:59:59Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Nikhilpawar1985](https://avatars.discourse-cdn.com/v4/letter/n/e68b1a/32.png) [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Post date:** [May 11, 2017, 3:59pm UTC](https://discuss.elastic.co/t/grok-filter/85444/1 "2017-05-11T15:59:59Z")
Hi , I am trying to construct grok filter to parse data (tomcat log ) but having issues . I am using input : [2017-05-09 16:27:53,156] :|: INFO :|: [dfprdsndl22.df.jabodo.com](http://dfprdsndl22.df.jabodo.com) :|: 6771ebd6eb814dc28e479908d542b6f6 :|: [BT:FF, BV:37, BL:en, CC:IN] :|: 103.42.89.250 :|: [http://download.filmfanatic.com/index.jhtml?partner=Z1xdm961&theme=01ab12212016&s2=-5658453153796672849&s1=618500](http://download.filmfanatic.com/index.jhtml?partner=Z1xdm961&theme=01ab12212016&s2=-5658453153796672849&s1=618500) :|: c.m.w.d.m.UnifiedLoggerWrapper :|: - [ET: DLPInfo, IP: 103.42.89.250] [2017-05-09 16:27:53,409] :|: INFO :|: [dfprdsndl22.df.jabodo.com](http://dfprdsndl22.df.jabodo.com) :|: 6771ebd6eb814dc28e479908d542b6f6 :|: [BT:FF, BV:37, BL:en, CC:IN] :|: 103.42.89.250 :|: [http://download.filmfanatic.com/index.jhtml?partner=Z1xdm961&theme=01ab12212016&s2=-5658453153796672849&s1=618500](http://download.filmfanatic.com/index.jhtml?partner=Z1xdm961&theme=01ab12212016&s2=-5658453153796672849&s1=618500) :|: c.m.w.d.m.UnifiedLoggerWrapper :|: - [ET: SplashPageServed, IP: 103.42.89.250] [2017-05-09 16:27:53,513] :|: INFO :|: [dfprdsndl22.df.jabodo.com](http://dfprdsndl22.df.jabodo.com) :|: :|: [BT:FF, BV:53, BL:en, CC:US] :|: 96.236.136.65 :|: [http://puzzlegamesdaily.dl.myway.com/blank.jhtml](http://puzzlegamesdaily.dl.myway.com/blank.jhtml) :|: c.m.w.d.m.UnifiedLoggerWrapper :|: - [ET: BlankPageServed, IP: 96.236.136.65] [2017-05-09 16:27:53,523] :|: INFO :|: [dfprdsndl22.df.jabodo.com](http://dfprdsndl22.df.jabodo.com) :|: f60bd13c2c154325b35edfa737166a15 :|: [BT:CHROME, BV:53, BL:en, CC:US] :|: 169.241.55.127 :|: :|: c.m.w.d.m.UnifiedLoggerWrapper :|: - [ET: ToolbarDetect, IP: 169.241.55.127] [2017-05-09 16:27:54,011] :|: INFO :|: [dfprdsndl22.df.jabodo.com](http://dfprdsndl22.df.jabodo.com) :|: :|: [BT:CHROME, BV:57, BL:en, CC:US] :|: 98.93.68.71 :|: :|: c.m.w.d.m.UnifiedLoggerWrapper :|: - [ET: PageView, IP: 98.93.68.71] Trying to get parse data in the format of timestamp :|: level :|: hostname :|: requestid :|:browser key :|: requestip :|: url :|: client ip What grok filter will be helpful for this ? Thanks, Nikhil ---
**Author:** ![Nikhilpawar1985](https://avatars.discourse-cdn.com/v4/letter/n/e68b1a/32.png) [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Post date:** [May 11, 2017, 5:20pm UTC](https://discuss.elastic.co/t/grok-filter/85444/2 "2017-05-11T17:20:16Z")
Current filter nt working filter { if [type] == "syslog" { mutate { gsub =\> ["message",":|:"," "] } grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog \_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 11, 2017, 5:44pm UTC](https://discuss.elastic.co/t/grok-filter/85444/3 "2017-05-11T17:44:04Z")
Well, a syslog grok expression won't work for non-syslog inputs. Have a look at the grok constructor web site for pointers. ---
**Author:** ![Nikhilpawar1985](https://avatars.discourse-cdn.com/v4/letter/n/e68b1a/32.png) [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Post date:** [May 11, 2017, 9:59pm UTC](https://discuss.elastic.co/t/grok-filter/85444/4 "2017-05-11T21:59:49Z")
Ok ..I have modified and restarted it . Still not seeing correct output on kibana filter { if [type] == "log" { mutate { gsub =\> ["message",":|:"," "] } grok { match =\> { "message" =\> "%{DATESTAMP:timestamp} %{WORD:severity} %{HOST:hostname} %{JAVACLASS:class} %{IP:clientip} %{GREEDYDATA:mess age}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["log\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 12, 2017, 3:48am UTC](https://discuss.elastic.co/t/grok-filter/85444/5 "2017-05-12T03:48:43Z")
Show us what you get. Copy/paste from the JSON tab in Kibana's discover view. No screenshots. ---
**Author:** ![Nikhilpawar1985](https://avatars.discourse-cdn.com/v4/letter/n/e68b1a/32.png) [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Post date:** [May 19, 2017, 7:03pm UTC](https://discuss.elastic.co/t/grok-filter/85444/6 "2017-05-19T19:03:08Z")
works with (?[[^]]_])%{SPACE}:|:%{SPACE}%{WORD:level}%{SPACE}:|:%{SPACE}%{USERNAME:hostname}%{SPACE}:|:%{SPACE}%{GREEDYDATA:coidkey}%{SPACE}:|:%{SPACE}%{GREEDYDATA:clientinfo}%{SPACE}:|:%{SPACE}%{IP:clientIP}%{SPACE}:|:%{SPACE}%{GREEDYDATA:Url}%{SPACE}:|:%{SPACE}%{JAVACLASS:class}%{SPACE}:|:%{SPACE}(?[[^]]_]) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2017, 7:03pm UTC](https://discuss.elastic.co/t/grok-filter/85444/7 "2017-06-16T19:03:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.