# Grok message pattern for log4j application log sample **URL:** \ **Category:** Logstash\ **Created:** [June 21, 2017, 8:14pm UTC](https://discuss.elastic.co/t/grok-message-pattern-for-log4j-application-log-sample/90356 "2017-06-21T20:14:42Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Bharath\_Raju](https://avatars.discourse-cdn.com/v4/letter/b/7ea924/32.png) [@Bharath\_Raju](https://discuss.elastic.co/u/Bharath_Raju)\ **Post date:** [June 21, 2017, 8:14pm UTC](https://discuss.elastic.co/t/grok-message-pattern-for-log4j-application-log-sample/90356/1 "2017-06-21T20:14:42Z")
I have below set of log4j lines in the log file - 2017 Jun 13 01:56:51:303 GMT +5 BW.CustomerInfo Info [BW-Core] BWENGINE-300001 Process Engine version 5.10.0, build V80\_Hotfix08, 2013-5-27 2017 Jun 13 01:56:51:305 GMT +5 BW.CustomerInfo Info [BW-Core] BWENGINE-300009 BW Plugins: version 5.10.0, build V80\_Hotfix08, 2013-5-27 2017 Jun 13 01:56:51:309 GMT +5 BW.CustomerInfo Info [BW-Core] BWENGINE-300010 XML Support: TIBCOXML Version 5.51.600.001 2017 Jun 13 01:56:51:310 GMT +5 BW.CustomerInfo Info [BW-Core] BWENGINE-300011 Java version: Java HotSpot(TM) 64-Bit Server VM 24.51-b03 2017 Jun 13 01:56:51:310 GMT +5 BW.CustomerInfo Info [BW-Core] BWENGINE-300012 OS version: amd64 Windows 8 6.2 2017 Jun 13 01:56:51:425 GMT +5 BW.CustomerInfo Info [BW-Core] BWENGINE-300013 Tibrv string encoding: UTF-8 2017 Jun 13 01:56:51:662 GMT +5 BW.CustomerInfo Info [BW\_Plugin] BW-HTTP-100500 Using the following HTTP minProcessors/maxProcessors [host=localhost port=3000]: 10/75 2017 Jun 13 01:56:52:061 GMT +5 BW.CustomerInfo Info [BW-Core] BWENGINE-300002 Engine CustomerInfo started 2017 Jun 13 01:56:52:210 GMT +5 BW.CustomerInfo Error [BW\_Plugin] BW-HTTP-100121 Activation error with process starter [Process Definition.process] Activation error with process starter [Process Definition.process] at com.tibco.pe.core.ProcessStarter.setState(Unknown Source) at com.tibco.pe.core.JobPool.if(Unknown Source) at com.tibco.pe.core.JobPool.resume(Unknown Source) at com.tibco.pe.core.JobPool.a(Unknown Source) at com.tibco.pe.core.JobPool.startNotFT(Unknown Source) What should be my pattern for message? filter { grok { match =\> { "message" =\> "\" } } date { match =\> {"@timestamp" =\> "yyyy MMM dd HH:mm:ss:SSS"} } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2017, 5:46am UTC](https://discuss.elastic.co/t/grok-message-pattern-for-log4j-application-log-sample/90356/2 "2017-06-22T05:46:13Z")
You can use the grok constructor site as a guide to creating grok expressions that match a particular line of input. ---
**Author:** ![Bharath\_Raju](https://avatars.discourse-cdn.com/v4/letter/b/7ea924/32.png) [@Bharath\_Raju](https://discuss.elastic.co/u/Bharath_Raju)\ **Post date:** [June 22, 2017, 6:59am UTC](https://discuss.elastic.co/t/grok-message-pattern-for-log4j-application-log-sample/90356/3 "2017-06-22T06:59:24Z")
Hi Magnus, Great...!!! Can't thank you enough. 😌 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 20, 2017, 6:59am UTC](https://discuss.elastic.co/t/grok-message-pattern-for-log4j-application-log-sample/90356/4 "2017-07-20T06:59:45Z")
Closed on July 20, 2017, 6:59am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.