# Grok Printer Log issue **URL:** \ **Category:** Logstash\ **Created:** [August 2, 2018, 7:20am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697 "2018-08-02T07:20:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Pinno\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)\ **Post date:** [August 2, 2018, 7:20am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697/1 "2018-08-02T07:20:29Z")
Hi, I want to grok the Printer Log and provide 10 records sample are below. ABC00720,ABC00720\_NB,TCPRINT501,5,1491672,A4,Microsoft Outlook - 備忘錄樣式,2018/08/01,22:42:42 ABC03951,ABC03951\_NB,RDPRINT501,6,545477,Letter (8.5 x 11"),DesignWare Cores Ethernet MAC Universal Databook, Version 3.73a,2018/07/31,21:40:24 ABC00137,ABC00137,TCPRINT502,1,988253,Letter (8.5 x 11"),費用-201807(含將群, 北美, 三達).xls,2018/07/24,16:24:56 ABC02563,ABC02563,TCPRINT501,5,1768223,Letter (8.5 x 11"),CNN Architectures: LeNet, AlexNet, VGG, GoogLeNet, ResNet and more ….,2018/07/23,10:36:48 ABC02805,ABC02805,RDPRINT202,1,424465,Japanese Envelope Chou #3,婚禮確認單\_20190605 0900 小明 CRY.pdf,2018/07/20,15:13:49 ABC00858,ABC00858,SZPRINT201,1,365519,Letter (8.5 x 11"),20180627 NB51026, NA51046, NA51051 MP Mask List.xlsx,2018/07/19,08:55:24 ABC00137,ABC00137,TCPRINT501,1,733614,Letter (8.5 x 11"),CNN-201807獎金報表(Round公式,修黎明18%,不扣健保費)\_扣除MD-胡小明.xls,2018/07/18,09:05:43 ABC00137,ABC00137,TCPRINT501,1,3054019,Letter (8.5 x 11"),20180703\_2018Q3(07-01~09-30)到期之維護費(附收據)(122件,NTD685,500)\_含收據.pdf,2018/07/12,10:41:36 ABC00134,ABC00134,TCPRINT401,17,23198140,16K 195x270 mm,Ch8-2018.pdf,2018/07/23,15:15:24 XA00256,XA00256,TCPRINT501,17,3250397,A4,Fast, Accurate, and, Lightweight Super-Resolution with Cascading Residual Network.pdf,2018/07/16,14:14:23 The Record column in order by User, Computer, Printer, Page, Size, Page Type, File Name, Date, Time. Total have 9 columns. I try to grok these log, but just only row 1 is correct. other record (row 2~10) get error data. My grok format is grok { match =\> { "message" =\> "%{GREEDYDATA:User},%{GREEDYDATA:Computer},%{GREEDYDATA:Printer},%{GREEDYDATA:Page},%{GREEDYDATA:Size},%{GREEDYDATA:PageType},%{GREEDYDATA:FileName},%{GREEDYDATA:PrintDate},%{GREEDYDATA:PrintTime}\s" } } How to get correct grok parse? Thanks ---
**Author:** ![alesnav](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@alesnav](https://discuss.elastic.co/u/alesnav)\ **Post date:** [August 2, 2018, 7:27am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697/2 "2018-08-02T07:27:34Z")
Hello! I would try csv filter instead of grok. Did you try it for this use case? Regards ---
**Author:** ![Pinno\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)\ **Post date:** [August 2, 2018, 7:35am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697/3 "2018-08-02T07:35:31Z")
Hi Alesnav, Thank for your Reply, I had try to use CSV filter, but i don't know how to set the separator parameter with default value ",". but file name value have "," sign. ---
**Author:** ![alesnav](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@alesnav](https://discuss.elastic.co/u/alesnav)\ **Post date:** [August 2, 2018, 8:22am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697/4 "2018-08-02T08:22:22Z")
The default separator for csv filter is "," as shown in [https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#plugins-filters-csv-separator](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#plugins-filters-csv-separator) so you don't have to configure it if you don't want to. ---
**Author:** ![Pinno\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)\ **Post date:** [August 2, 2018, 8:53am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697/5 "2018-08-02T08:53:49Z")
Hi alesnav, Thank for your reply. I know that the default separator is "," But the file name include "," , So it will get \_csvparsefailure in tag and can't parse it. For example in Row 2, the file name is "DesignWare Cores Ethernet MAC Universal Databook, Version 3.73a" **CSV Filter** csv { columns =\> ["User","Computer","Printer","Pages","Size","PageType","FileName","PrintDate","PrintTimet"] } **Parse Result:** { \_index: "sec-prt-csv", \_type: "doc", \_id: "rlPM-WQBe4qwmz3\_mvWi", \_score: 1, \_source: { @timestamp: "2018-08-02T08:40:31.706Z", @version: "1", path: "/u1/LogCollect/lab.csv", host: "OAELKT-L1", message: "ABC03951,ABC03951\_NB,RDPRINT501,6,545477,Letter (8.5 x 11"),DesignWare Cores Ethernet MAC Universal Databook, Version 3.73a,2018/07/31,21:40:24 ", tags: [ "SEC-PRT-CSV", "\_csvparsefailure" ] } } ---
**Author:** ![Pinno\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)\ **Post date:** [August 3, 2018, 3:11am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697/6 "2018-08-03T03:11:45Z")
I has fixed the file name with "," sign issue, Change the source log format for file name. grok { match =\> { "message" =\> "%{GREEDYDATA:User},%{GREEDYDATA:Computer},%{GREEDYDATA:Printer},%{GREEDYDATA:Page},%{GREEDYDATA:Size},%{GREEDYDATA:PageType},\|%{GREEDYDATA:FileName}\|,%{GREEDYDATA:PrintDate},%{GREEDYDATA:PrintTime}\s" } } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 31, 2018, 3:11am UTC](https://discuss.elastic.co/t/grok-printer-log-issue/142697/7 "2018-08-31T03:11:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.