Grok to parse SAP NetWeaver access logs

[zhmq0124v (Mingquan Zhang)]

Hi,

I am trying to parse the following log but failed, as you can see first 12 lines are not needed and from line 12 it's CATALINA_DATESTAMP, client ip, http verb, URL, http version, http code, data size and response time.
How to parse this log file? I am stuck at grok match, thanks.

Best regards,
Mike

[zhmq0124v (Mingquan Zhang)]

After browsing this forum, I found the pattern, thank you all.

filter {
if [path] =~ "access" {
mutate { replace => { "type" => "pqm_access" } }
grok {
match => { "message" => "[%{CATALINA_DATESTAMP:timestamp}] - %{IPV4:clientip} : %{WORD:verb} %{NOTSPACE:rawrequest} %{NOTSPACE:httpversion} %{NUMBER:httpcode} %{NUMBER:respbytes} [%{NUMBER:resptime}]" }
}
}
date {
match => [ "timestamp" , "MMM dd, YYYY hh:mm:ss a" ]
}
}