# Grok pattern creation

**URL:** https://discuss.elastic.co/t/grok-pattern-creation/135467
**Category:** Logstash
**Created:** [June 12, 2018, 6:52am UTC](https://discuss.elastic.co/t/grok-pattern-creation/135467 "2018-06-12T06:52:35Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![hitman](https://avatars.discourse-cdn.com/v4/letter/h/48db29/32.png) [@hitman](https://discuss.elastic.co/u/hitman)
#### Post date: [June 12, 2018, 6:52am UTC](https://discuss.elastic.co/t/grok-pattern-creation/135467/1 "2018-06-12T06:52:36Z")

</div>

2018-05-25 10:53:15.8779 fucntionality:nil request:enter user\_id:3623 school\_id:4 result:success username:(('Reka',),)  
2018-05-25 10:53:15.8888 functionality:nil request:enter user\_id:3648 school\_id:8 result:success username:(('AMRUTh',),)  
2018-05-25 10:53:16.8388 functionality:nil request:enter user\_id:6000 school\_id:9 result:success username:(('Sahu',),)

can anyone please create grok pattern for the above logs

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 12, 2018, 8:04am UTC](https://discuss.elastic.co/t/grok-pattern-creation/135467/2 "2018-06-12T08:04:58Z")

</div>

I suggest you use a grok or a dissect filter to extract two fields from each log message:

- One field with the timestamp.
- One field with the rest of the string (containing the key:value pairs at the end).

Then use a a kv filter to parse the field with the key:value pairs.

---

<div class="post-metadata">

### Author: ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)
#### Post date: [June 12, 2018, 8:03pm UTC](https://discuss.elastic.co/t/grok-pattern-creation/135467/3 "2018-06-12T20:03:16Z")

</div>

Here are some good links used for creating groks that I have found useful/bookmark:  
[http://grokconstructor.appspot.com/do/constructionstep](http://grokconstructor.appspot.com/do/constructionstep)  
[http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)  
[https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expression-language-quick-reference#quantifiers](https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expression-language-quick-reference#quantifiers)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 10, 2018, 8:03pm UTC](https://discuss.elastic.co/t/grok-pattern-creation/135467/4 "2018-07-10T20:03:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.