# Help with parse logs not standardized

**URL:** <https://discuss.elastic.co/t/help-with-parse-logs-not-standardized/223618>\
**Category:** Logstash\
**Created:** [March 14, 2020, 2:26pm UTC](https://discuss.elastic.co/t/help-with-parse-logs-not-standardized/223618 "2020-03-14T14:26:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ernest\_Lachowicz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernest_lachowicz/32/63893_2.png) [@Ernest\_Lachowicz](https://discuss.elastic.co/u/Ernest_Lachowicz)\
**Post date:** [March 14, 2020, 2:26pm UTC](https://discuss.elastic.co/t/help-with-parse-logs-not-standardized/223618/1 "2020-03-14T14:26:11Z")

</div>

Hi,  
I'm starting my adventure with Logstash (ELK). I would like parse logs:

```
2020-02-11 15:10:17.435 DEV_CTRL UPPER OUTPUT/ue/ue1/dev_ctrl/logger IMSI=01723600 Sending message BearerContextReleased: BearerContextReleased: imsi=01723600
2020-02-11 15:10:17.436 EVENT /ue/ue1/logger IMSI=01723600 Send delete default bearer for imsi: 01723600 has finished
2020-02-11 15:10:17.436 NAS STATE /ue/ue1/nas/logger IMSI=01723600 EpsBearerId=EPS51 From: BEARER CONTEXT ACTIVE To: BEARER CONTEXT INACTIVE
2020-02-11 15:10:17.436 INTERNAL LOWER OUTPUT/ue/ue1/internal/logger IMSI=0101723600 Sending message DeleteDefaultBearer: primitiveIdentity {
2020-02-11 15:10:17.405 LOWER INPUT/logger IMSI=0101723601 LowerUeId=4 PCI=18 CELL=cell1 Receiving message CRLC_RB_CONFIG_CNF
  pid: DeleteDefaultBearer
}
deleteDefaultBearer {
  ueId {
    ueId: 58
    imsi: 2101723600
  }
  epsBearerId: 51
}

```

I started with Logstash and grok filter. It is a very difficult to build grok pattern to match all logs.  
When I created grok pattern for one line: %{TIMESTAMP\_ISO8601}%{SPACE}%{WORD:Layer}%{SPACE}%{WORD:From}%{SPACE}%{WORD:Where}\s\*%{PATH}%{SPACE}%{WORD:IMSI}=%{INT:Imsi}%{SPACE}%{WORD:Action}%{SPACE}%{WORD:what}%{SPACE}%{WORD:Message}:\s+%{DATA:Message\_content}.

In logs I have got information:  
`[2020-03-14T13:08:27,577][WARN][logstash.filters.grok] Timeout executing grok '%{TIMESTAMP_ISO8601}%{SPACE}%{WORD:Layer}%{SPACE}%{WORD:From}%{SPACE}%{WORD:Where}\s*%{PATH}%{SPACE}%{WORD:IMSI}=%{INT:Imsi}%{SPACE}%{WORD:Action}%{SPACE}%{WORD:what}%{SPACE}%{WORD:Message}:\s+%{DATA:Message_content}' against field 'message' with value`

Can you advise me how to parse this kind of logos? I tried also with Dissect filter but so far I have a problem with start logstash with this filter in docker.

Regards,  
Ernest

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 14, 2020, 6:22pm UTC](https://discuss.elastic.co/t/help-with-parse-logs-not-standardized/223618/2 "2020-03-14T18:22:51Z")

</div>

UNIXPATH (which is part of PATH) is [extremely expensive](https://github.com/logstash-plugins/logstash-patterns-core/issues/159) when it does not match. At the very least you should [anchor your patten](https://www.elastic.co/blog/do-you-grok-grok) to the start of line using ^.

---

<div class="post-metadata">

**Author:** ![Ernest\_Lachowicz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernest_lachowicz/32/63893_2.png) [@Ernest\_Lachowicz](https://discuss.elastic.co/u/Ernest_Lachowicz)\
**Post date:** [March 16, 2020, 9:12am UTC](https://discuss.elastic.co/t/help-with-parse-logs-not-standardized/223618/3 "2020-03-16T09:12:20Z")

</div>

Hi,  
I changed PATH on regex expression and add ^ on the beginning of line . Now I do not have got error logs. Thank you.

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [March 16, 2020, 9:28am UTC](https://discuss.elastic.co/t/help-with-parse-logs-not-standardized/223618/4 "2020-03-16T09:28:06Z")

</div>

Hi Ernest,

if Badger's answer sorted out your problem, please set it as a solution. That way future readers will know this thread has been solved.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2020, 9:28am UTC](https://discuss.elastic.co/t/help-with-parse-logs-not-standardized/223618/5 "2020-04-13T09:28:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.