# Help on Filters

**URL:** <https://discuss.elastic.co/t/help-on-filters/119240>\
**Category:** Logstash\
**Created:** [February 9, 2018, 1:14pm UTC](https://discuss.elastic.co/t/help-on-filters/119240 "2018-02-09T13:14:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\
**Post date:** [February 9, 2018, 1:14pm UTC](https://discuss.elastic.co/t/help-on-filters/119240/1 "2018-02-09T13:14:54Z")

</div>

Hi All,

Need help to create a logstash filter for the below log format.

router#001(26322) 2018/02/09 00:00:17 -FKSPT- {2:2} Read from QMGR:INPUT\_IN[wmqin(srid)] \<Message(candidate =\> unknown, id =\> (2)"-1", userref =\> (13)"1830300016.01", reference =\> (12)"MM1801506848", relatedref =\> (16)"BALAL2L0000RAMAN2L", message\_id =\> (20)"20180209MM1801506848", system\_id =\> (29)"TNV20180209000017-24761-26322")\>

## I want the to insert to elasticsearch as below

"router" : "router#002(99253)",  
"INTIME" : "2018/02/09 00:00:17"  
"level" : "-FKSPT-"  
"INMSG" : "Read from QMGR:INPUT\_IN[wmqin(srid)]"  
"MSGID" : "20180209MM1801506848"  
"SYSID" : "TNV20180209000017-24761-26322"

Please help me to get the grok code for the above log format... Thanks,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2018, 1:15pm UTC](https://discuss.elastic.co/t/help-on-filters/119240/2 "2018-03-09T13:15:00Z")

</div>

Closed on March 9, 2018, 1:15pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.