# Grok type

**URL:** <https://discuss.elastic.co/t/grok-type/118014>\
**Category:** Logstash\
**Created:** [February 1, 2018, 12:11pm UTC](https://discuss.elastic.co/t/grok-type/118014 "2018-02-01T12:11:29Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 1, 2018, 12:11pm UTC](https://discuss.elastic.co/t/grok-type/118014/1 "2018-02-01T12:11:29Z")

</div>

what grok i should use for " (http-WEB0001VR%2F10.351.100.19-1000-15) "

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 1, 2018, 12:44pm UTC](https://discuss.elastic.co/t/grok-type/118014/2 "2018-02-01T12:44:46Z")

</div>

What is the desired result?

---

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 1, 2018, 1:27pm UTC](https://discuss.elastic.co/t/grok-type/118014/3 "2018-02-01T13:27:35Z")

</div>

For below log the given grok is matching in grokdebug but not working in logstash any idea ??? ☹

# Log:

2018-01-31 00:00:11,896 INFO [STDOUT] (http-WEB0001VR%2F10.351.100.19-1000-15) 00:00:11,896 [com.test.tst.connectivity.fddInvoker] INFO - TVS MSG Response [CUSTOMER,PARTY.INFO/I/PROCESS///,\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*//IN00111521,5269453]

# Grok

%{TIMESTAMP\_ISO8601:timestamp} \*%{LOGLEVEL:Status} \*[%{DATA:thread}] \*(%{DATA:Server}%%{DATA:IP}-%{DATA:PORT}-%{DATA:Request\_Response\_ID} \*%{TIME:Duration} \*[%{JAVACLASS:Class}] \*%{LOGLEVEL:Core\_Status} - %{DATA:Response\_From} \*[%{GREEDYDATA:Log}]

# Website Used : [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

 ![Groke%201](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f68fb03e4130183015d9f07702d9167198f5e1b5.JPG)

 ![Grok%202](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f9e11d2b49e17646f6aa69e1a27bdbad1ec50f93.JPG)!

The above image has the desired output

logstash.conf

Filter part :

filter {  
grok {  
match =\> [  
"message",  
"%{TIMESTAMP\_ISO8601:timestamp} \*%{LOGLEVEL:Status} \*[%{DATA:thread}] \*(%{DATA:Server}%%{DATA:IP}-%{DATA:PORT}-%{DATA:Request\_Response\_ID} \*%{TIME:Duration} \*[%{JAVACLASS:Class}] \*%{LOGLEVEL:Core\_Status} - %{DATA:Response\_From} \*[%{GREEDYDATA:Log}]"  
]

}  
}

Thanks in advance...

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 1, 2018, 1:29pm UTC](https://discuss.elastic.co/t/grok-type/118014/4 "2018-02-01T13:29:46Z")

</div>

Don't use more than one DATA or GREEDYDATA in the same expression. It's computationally expensive and unreliable. Addressing that might fix the problem you're having.

---

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 1, 2018, 1:36pm UTC](https://discuss.elastic.co/t/grok-type/118014/5 "2018-02-01T13:36:07Z")

</div>

can you guide me with some other alternate grok ??

---

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 1, 2018, 1:58pm UTC](https://discuss.elastic.co/t/grok-type/118014/6 "2018-02-01T13:58:26Z")

</div>

For (http-WEB0001VR%2F10.351.100.19-1000-15) i wanna split it into

"Server" : " http-WEB0001VR%2F10.351.100.19",

"Port" : "1000" &

"Response id" : "15"

How to do it without using DATA please advice.

---

<div class="post-metadata">

**Author:** ![muthu1086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthu1086/32/27256_2.png) [@muthu1086](https://discuss.elastic.co/u/muthu1086)\
**Post date:** [February 1, 2018, 2:58pm UTC](https://discuss.elastic.co/t/grok-type/118014/7 "2018-02-01T14:58:21Z")

</div>

You can use below grok for splitting (http-WEB0001VR%2F10.351.100.19-1000-15)

(?[a-z]+-[a-zA-Z0-9]+%[a-zA-Z0-9]+.[0-9]+.[0-9]+.[0-9]+)-(?[0-9]+)-(?[0-9]+)

{  
"Server": [  
[  
"http-WEB0001VR%2F10.351.100.19"  
]  
],  
"port": [  
[  
"1000"  
]  
],  
"Response id": [  
[  
"15"  
]  
]  
}

---

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 2, 2018, 4:26am UTC](https://discuss.elastic.co/t/grok-type/118014/8 "2018-02-02T04:26:48Z")

</div>

![GERR3](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8c25b79e4468e0914679784850d31a56e79e5fd5.JPG)

Input Log:  
2018-01-31 00:00:11,896 INFO [STDOUT] (http-WEB0001VR%2F10.351.100.19-1000-15) 00:00:11,896 [com.test.tst.connectivity.fddInvoker] INFO - TVS MSG Response [CUSTOMER,PARTY.INFO/I/PROCESS///,\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*//IN00111521,5269453]

Grok Used

%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:Status} \*[%{DATA:thread}] (?[a-z]+-[a-zA-Z0-9]+%[a-zA-Z0-9]+.[0-9]+.[0-9]+.[0-9]+)-(?[0-9]+)-(?[0-9]+) \*%{TIME:Duration} \*[%{JAVACLASS:Class}] \*%{LOGLEVEL:Core\_Status} - %{DATA:Response\_From} \*[%{GREEDYDATA:Log}]

Separately its working but when put to gather its not working ☹

---

<div class="post-metadata">

**Author:** ![muthu1086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muthu1086/32/27256_2.png) [@muthu1086](https://discuss.elastic.co/u/muthu1086)\
**Post date:** [February 2, 2018, 4:49am UTC](https://discuss.elastic.co/t/grok-type/118014/9 "2018-02-02T04:49:45Z")

</div>

I think you are missing something. Am able to get the filter working.

![com](https://us1.discourse-cdn.com/elastic/original/3X/1/1/110edf0eeba054b9d85e43565167489ef374ec1a.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2018, 4:50am UTC](https://discuss.elastic.co/t/grok-type/118014/10 "2018-03-02T04:50:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.