# Grok Pattern against stdout
**URL:** https://discuss.elastic.co/t/grok-pattern-against-stdout/258195
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [December 9, 2020, 10:16pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195 "2020-12-09T22:16:32Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@willis](https://discuss.elastic.co/u/willis)
#### Post date: [December 9, 2020, 10:16pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195/1 "2020-12-09T22:16:32Z")
I have a custom log format that is being sent to stdout. Filebeat is correctly capturing this output. I would like to apply a grok pattern against these lines and have them parsed/indexed. Is a pipeline, a processor, or something else the best way to do this? I only want to apply the processor or pipeline against the lines that have a specific string (e.g. "ERRORLINE").
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [December 9, 2020, 10:46pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195/2 "2020-12-09T22:46:34Z")
If you are already using Logstash then I would recommend [doing it there](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html).
If you don't ever plan on using Logstash then I would recommend an [ingest processor](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/grok-processor.html).
---
### Author:  [@willis](https://discuss.elastic.co/u/willis)
#### Post date: [December 10, 2020, 4:42pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195/3 "2020-12-10T16:42:16Z")
Thank you! We do not use logstash.
I have multiple log types that are sent to stdout. How do I configure filebeat to run the ingest processor if it sees a specific string (e.g. ERRORLINE)? Or is that something that is configured on the ES side?
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [December 10, 2020, 8:02pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195/4 "2020-12-10T20:02:18Z")
Check out the [pipeline documentation](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#pipelines-option-es).
So I would setup a pipeline in ES to process this and use the Grok processor. But you can also do some conditionals so only run that processor based on that specific condition you are mentioning. That way you don't waste processing on data that doesn't need to go through that pipeline.
---
### Author:  [@willis](https://discuss.elastic.co/u/willis)
#### Post date: [December 11, 2020, 9:21pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195/5 "2020-12-11T21:21:48Z")
Thanks! That got it.
For those interested in a solution. For background, our setup is kubernetes. Filebeat runs as a daemonset and one of our pods was producing two log types. The first log type has an existing module. The second log type was custom. Both are written to stdout. The solution was to:
1. Create a pipeline with a grok ingest processor on the ElasticSearch side.
2. In filebeat config map add the following:
```auto
output.elasticsearch:
hosts: ['elasticsearch-url']
indices:
- index: "customformat"
when.contains:
message: "ERRORLINE-CUSTOMFORMAT"
pipelines:
- pipeline: "customformat-processing-pipeline"
when.contains:
message: "ERRORLINE-CUSTOMFORMAT"
```
The custom log line pipeline is only applied in specific cases to save on processing. Also, these documents are written to their own index.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2021, 11:21pm UTC](https://discuss.elastic.co/t/grok-pattern-against-stdout/258195/6 "2021-01-08T23:21:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.