# Grok jenkins console logs

**URL:** <https://discuss.elastic.co/t/grok-jenkins-console-logs/194577>\
**Category:** Logstash\
**Created:** [August 9, 2019, 9:26am UTC](https://discuss.elastic.co/t/grok-jenkins-console-logs/194577 "2019-08-09T09:26:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chaymaa](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@chaymaa](https://discuss.elastic.co/u/chaymaa)\
**Post date:** [August 9, 2019, 9:26am UTC](https://discuss.elastic.co/t/grok-jenkins-console-logs/194577/1 "2019-08-09T09:26:55Z")

</div>

Hi All,  
I have a problem on groking jenkins console log, i have tested the filter instructions using input type file and it's OK but when i implement this configuration using a tcp input type the results is not the same.

the content of input file is:  
002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Connexion] Summary | Status : Passed  
002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Creation\_Modele] Summary | Status : Passed  
002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Ajout\_Document\_Errone\_Circuit] Summary | Status : Passed

**logstash.conf:**  
input {  
file {  
path =\> ["c:/aaa.txt"]  
start\_position =\> "beginning"  
}  
}

filter {  
grok {  
match =\> {  
"message" =\> "%{WORD:scenario} : %{WORD:action} %{DATA:feature} %{DATA:action} : %{WORD:status}"  
}  
remove\_field =\> ["action"]  
add\_field =\> {"date" =\> "%{+YYYY.MM.dd}"}  
}  
}  
**Kibana results OK:**  
{ "path" =\> "c:/aaa.txt",  
"status" =\> "Passed",  
"feature" =\> "[connexion]",  
"date" =\> "2019.08.08",  
"message" =\> ""002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Connexion] Summary | Status : Passed",\r",  
"scenario" =\> "002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele",  
}  
{  
"path" =\> "c:/aaa.txt",  
"status" =\> "Passed",  
"feature" =\> "[Creation\_Modele]",  
"date" =\> "2019.08.08",  
"message" =\> ""002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Creation\_Modele] Summary | Status : Passed",\r",  
"scenario" =\> "002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele",  
}  
The problem is there, when i implement that using tcp input, i expect the same result but is not true:  
**jenkins console logs:**  
Démarré par l'utilisateur Jenkins  
Construction à distance sur windowsServer2 in workspace C:\Automatisation\workspace\Report  
[WS-CLEANUP] Deleting project workspace...  
C:\Automatisation\workspace\Report\>exit 0  
[Report] $ cmd /c call C:\Users\ADMINI~1.WIN\AppData\Local\Temp\2\jenkins8691771370815427256.bat  
C:\Automatisation\workspace\Report\>C:/Automatisation/affichage.bat  
002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Connexion] Summary | Status : Passed  
002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Creation\_Modele] Summary | Status : Passed

**logstash conf:**  
input { tcp{port =xxxx }}  
filter {  
json{  
sources =\> "message"}  
grok {  
match =\> {  
"message" =\> "%{WORD:scenario} : %{WORD:action} %{DATA:feature} %{DATA:action} : %{WORD:status}"  
}  
remove\_field =\> ["action"]  
}  
}

**kibana result:**  
{  
message =\> "..... Démarré par l'utilisateur ...."  
"status" =\> [  
[0] "Passed",  
[1] "Passed",  
],  
"feature" =\> [  
[0] "[Connexion]",  
[1] "[Creation\_Modele]",  
],  
"scenario" =\> [  
[0] "002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele",  
[1] "002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele",  
],  
}  
i dont have scenario , feature and status in separated document, i have one document containing table of values.  
When i remove json{ ..} part i have one document result contains the grok result of the first line (002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele : Action1 [Connexion] Summary | Status : Passed) the following lines ares not goked.

can someone help me please, thnx in advance.

---

<div class="post-metadata">

**Author:** ![chaymaa](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@chaymaa](https://discuss.elastic.co/u/chaymaa)\
**Post date:** [August 28, 2019, 4:15pm UTC](https://discuss.elastic.co/t/grok-jenkins-console-logs/194577/2 "2019-08-28T16:15:31Z")

</div>

Hi all,

The problem is resolved, i had grok my log as following:

filter {  
json{source =\> "message"}  
split{ field =\> "message"}  
grok {  
match =\> {  
"message" =\> "%{WORD:scenario} : %{WORD:action} %{DATA:feature} %{DATA:action} : %{WORD:status}"  
}  
remove\_field =\> ["action"]  
add\_field =\> {"date" =\> "%{+YYYY.MM.dd}"}  
remove\_field =\> ["data"]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2019, 4:15pm UTC](https://discuss.elastic.co/t/grok-jenkins-console-logs/194577/3 "2019-09-25T16:15:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.