# Help to GROK parse JBoss EAP 6 access log

**URL:** <https://discuss.elastic.co/t/help-to-grok-parse-jboss-eap-6-access-log/82306>\
**Category:** Logstash\
**Created:** [April 13, 2017, 2:02pm UTC](https://discuss.elastic.co/t/help-to-grok-parse-jboss-eap-6-access-log/82306 "2017-04-13T14:02:16Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![bsl.lacerda](https://avatars.discourse-cdn.com/v4/letter/b/c67d28/32.png) [@bsl.lacerda](https://discuss.elastic.co/u/bsl.lacerda)\
**Post date:** [April 13, 2017, 3:06pm UTC](https://discuss.elastic.co/t/help-to-grok-parse-jboss-eap-6-access-log/82306/2 "2017-04-13T15:06:34Z")

</div>

Problem solved!!!

The tip was found in [Grokparsefailure, but works in grok debugger](https://discuss.elastic.co/t/grokparsefailure-but-works-in-grok-debugger/45613)

The Logstash message was a bit different, it was:

200.155.87.165 - - [13/Apr/2017:11:00:33 -0300] "GET /ibhbagendamentoacao/compra.jsf?CTL=3178956819215030102050 HTTP/1.1" 200 38752 "[https://www.hb.prebanco.com.br/ibhbagendamentoacao/acompanhamento.jsf?CTL=3178956819215030102050](https://www.hb.prebanco.com.br/ibhbagendamentoacao/acompanhamento.jsf?CTL=3178956819215030102050)" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/7.0)" 247 0.247

And the proper regex become:

%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{NOTSPACE:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} %{NUMBER:bytes} %{QS:referer} %{QS:agent} %{NUMBER:microsecond:int} %{NUMBER:second:float}

See you.

---

_[View the full topic](https://discuss.elastic.co/t/help-to-grok-parse-jboss-eap-6-access-log/82306)._