# Grok pattern construction

**URL:** <https://discuss.elastic.co/t/grok-pattern-construction/301610>\
**Category:** Logstash\
**Created:** [April 5, 2022, 9:35am UTC](https://discuss.elastic.co/t/grok-pattern-construction/301610 "2022-04-05T09:35:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [April 5, 2022, 9:35am UTC](https://discuss.elastic.co/t/grok-pattern-construction/301610/1 "2022-04-05T09:35:05Z")

</div>

Hi, I need help constructing the grok pattern for the following log messages

```auto
Fri Mar 18 17:43:27 2022 : Info: Debugger not attached
Fri Mar 18 17:43:27 2022 : Info: Loaded virtual server inner-tunnel
Fri Mar 18 17:43:27 2022 : Info: Loaded virtual server <default>

```

TIMESTAMP\_ISO8601 does not seem to match the format.  
new to elk, help would be appreciated

Thank you!

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [April 6, 2022, 9:14am UTC](https://discuss.elastic.co/t/grok-pattern-construction/301610/2 "2022-04-06T09:14:44Z")

</div>

Hi,

The date you have don't fit TIMESTAMP\_ISO8601 pattern.  
I think it fit [this one](https://github.com/hpcugent/logstash-patterns/blob/aaede7a2e508c1a37816bff9d9824772f1eed78d/files/grok-patterns#L80).

So the grok filter should look like this :  
`%{HTTPDERROR_DATE:date}\s:\s%{LOGLEVEL:log}:%{GREEDYDATA:comment}`

Cad.

---

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [April 6, 2022, 9:16am UTC](https://discuss.elastic.co/t/grok-pattern-construction/301610/3 "2022-04-06T09:16:47Z")

</div>

It works, Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2022, 9:17am UTC](https://discuss.elastic.co/t/grok-pattern-construction/301610/4 "2022-05-04T09:17:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.