# Help with Grok Pattern for SAS log

**URL:** <https://discuss.elastic.co/t/help-with-grok-pattern-for-sas-log/79584>\
**Category:** Logstash\
**Created:** [March 22, 2017, 12:48pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-for-sas-log/79584 "2017-03-22T12:48:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DamonWolmarans](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@DamonWolmarans](https://discuss.elastic.co/u/DamonWolmarans)\
**Post date:** [March 22, 2017, 12:48pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-for-sas-log/79584/1 "2017-03-22T12:48:30Z")

</div>

Hi!

I have just started playing with the Elastic Stack and I am a complete noob, so please treat this as such.

I need help in constructing a grok filter for some logs i am parsing to Logstash, more specifically I need help breaking down the "GREEDYDATA" portion so i can use the information within.

Here are a few log file lines for reference:

```
2017-02-28T12:33:27,569 INFO [00000035] :a196046 - NOTE: DATA statement used (Total process time):
2017-02-28T12:33:27,570 INFO [00000035] :a196046 - real time 0.55 seconds
2017-02-28T12:33:27,570 INFO [00000035] :a196046 - user cpu time 0.02 seconds
2017-02-28T12:33:27,570 INFO [00000035] :a196046 - system cpu time 0.18 seconds

```

I am using the following Grok filter:

```
filter {
 if [type] == "saslog" {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{GREEDYDATA:msg}" }
      }
    }
 }

```

How can I break this down further so that I can use the information in the GREEDYDATA such as CPU time?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [March 23, 2017, 4:16am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-for-sas-log/79584/2 "2017-03-23T04:16:53Z")

</div>

[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) and [https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns](https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns) are your friends when creating Grok patterns. I'm not sure how you want to parse the log, so I just give an example

To parse this line

```auto
2017-02-28T12:33:27,570 INFO [00000035] :a196046 - user cpu time 0.02 seconds

```

use

```auto
%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} user cpu time %{SPACE} %{NUMBER:user_cpu_time} seconds

```

so the config could look like:

```auto
filter {
 if [type] == "saslog" {
    grok {
        match => { "message" => [
                    "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} user cpu time %{SPACE} %{NUMBER:user_cpu_time} seconds",
                    "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} system cpu time %{SPACE} %{NUMBER:system_cpu_time} seconds"
                    
                ]
            }
        }
    }
 }

```

Add more Grok patterns as necessary.

---

<div class="post-metadata">

**Author:** ![DamonWolmarans](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@DamonWolmarans](https://discuss.elastic.co/u/DamonWolmarans)\
**Post date:** [March 23, 2017, 7:59am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-for-sas-log/79584/3 "2017-03-23T07:59:21Z")

</div>

Thank you Anh!  
It worked like a charm.

For anyone else coming across this, my grok filter ended up looking like this:

```
filter {
 if [type] == "saslog" {
    grok {
        match => { "message" => [
                    "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} real time %{SPACE} %{NUMBER:real_time} seconds",
                    "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} user cpu time %{SPACE} %{NUMBER:user_cpu_time} seconds",
                    "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} system cpu time %{SPACE} %{NUMBER:system_cpu_time} seconds",
                    "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} memory %{SPACE} %{NUMBER:memory} seconds",
                    "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{NOTSPACE} :%{USERNAME:user} - %{SPACE} OS Memory %{SPACE} %{NUMBER:OS_memory} seconds"
                    
                ]
            }
        }
    }
        if "_grokparsefailure" in [tags] {      
        drop { }
 }
}

```

Just added the code to drop any logs that do not match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2017, 7:59am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-for-sas-log/79584/4 "2017-04-20T07:59:22Z")

</div>

Closed on April 20, 2017, 7:59am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.