# Grok Pattern to get response\_time and app\_id from Pivotal CloudFoundry Loggregator

**URL:** <https://discuss.elastic.co/t/grok-pattern-to-get-response-time-and-app-id-from-pivotal-cloudfoundry-loggregator/26964>\
**Category:** Logstash\
**Created:** [August 6, 2015, 11:17am UTC](https://discuss.elastic.co/t/grok-pattern-to-get-response-time-and-app-id-from-pivotal-cloudfoundry-loggregator/26964 "2015-08-06T11:17:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amit\_Hora](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_hora/32/45312_2.png) [@Amit\_Hora](https://discuss.elastic.co/u/Amit_Hora)\
**Post date:** [August 6, 2015, 11:17am UTC](https://discuss.elastic.co/t/grok-pattern-to-get-response-time-and-app-id-from-pivotal-cloudfoundry-loggregator/26964/1 "2015-08-06T11:17:44Z")

</div>

Hi All,

I am trying to get few fields from Logs of my app on Pivotal Cloud Foundry to analyze them using ELK but not able to get all the fields ,below is log from my APP

2015-08-03T09:51:15.000+00:00 [RTR] OUT [mm1-spring-music.example.kpit.com](http://mm1-spring-music.example.kpit.com) - [03/08/2015:09:51:15 +0000] "GET /assets/templates/albums.html HTTP/1.1" 200 1307 "[http://mm1-spring-music.pcfdev.example.com/](http://mm1-spring-music.pcfdev.example.com/)" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36" XX.XX.XXX.XX:XXX 1x\_forwarded\_for:"XXX.XX.2XX.XXX, XX.XX.XXX.XX" vcap\_request\_id:7962cc63-e589-409a-59c5-3d14a640fa74 response\_time:0.002220537 app\_id:08be9fc8-c7a3-4613-bf12-1a9c7d98cc27

using below pattern i am able to get fields like AppName,TimeStamp,Process,MsgType(Error or Warn) but i want to get Agent\_used,Response\_Time and App\_id if present in logs like in above case

Pattern i have used is

```
filter {
if [type] == "syslog" {
    grok {
      match => { "message"=>"(?:%{TIMESTAMP_ISO8601:timestamp}|-) +(?:%{SYSLOG5424SD:process}|-) +(?:%{WORD:msgtype}|-) +(?:%{NOTSPACE:appname}|-) +(?:%{GREEDYDATA:foundry_message}|-)"
}

  add_field => ["received_at", "%{@timestamp}"]
  add_field => ["received_from", "%{host}"]

}
syslog_pri { }
date {
   match => ["syslog_ts", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
  }

```

}

Kindly suggest how to get the remaining fields.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 7, 2015, 8:24am UTC](https://discuss.elastic.co/t/grok-pattern-to-get-response-time-and-app-id-from-pivotal-cloudfoundry-loggregator/26964/2 "2015-08-07T08:24:55Z")

</div>

Probably cause that last greedydata will grab them.

Check out [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) and see if you can build something.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/grok-pattern-to-get-response-time-and-app-id-from-pivotal-cloudfoundry-loggregator/26964/3 "2017-07-06T05:32:38Z")

</div>

Closed on July 6, 2017, 5:32am UTC