# How can sort assorted logs to steam line logs **URL:** \ **Category:** Logstash\ **Created:** [September 1, 2018, 1:47pm UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943 "2018-09-01T13:47:25Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\ **Post date:** [September 1, 2018, 1:47pm UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/1 "2018-09-01T13:47:25Z")
I have below assorted logs, how can i sort to Time Device Source only log message and remove rest all unwanted log message Sep 1 14:40:33 VPX-02 09/01/2018:13:40:33 GMT VPX-02 0-PPE-0 : default API CMD\_EXECUTED 523995 0 : User nsroot - Remote\_ip 192.168.255.47 - Command "stat ns" - Status "Success" Sep 1 14:40:33 VPX-01 09/01/2018:13:40:33 GMT VPX-01 0-PPE-0 : default API CMD\_EXECUTED 525164 0 : User nsroot - Remote\_ip 192.168.255.47 - Command "stat ns" - Status "Success" Sep 1 14:40:34 SWIAS02 7187590: Sep 1 14:40:33.081 BST: %ILPOWER-5-IEEE\_DISCONNECT: Interface Fa1/0/39: PD removed Sep 1 14:43:41 SITEIAS01 599982: Sep 1 14:43:40.604 BST: %ADJ-5-RESOLVE\_REQ\_FAIL: Adj resolve request failed for 10.188.98.231 on Vlan498 Sep 1 14:43:42 BRANCH01 BST: %PLATFORM\_STACKPOWER-4-REDUNDANCY\_LOSS: Switch 1's power stack lost redundancy and is now operating in power sharing mode Sep 1 14:43:42 BRANCH2 1025166: Sep 1 14:43:41.893 BST: %SEC-6-IPACCESSLOGP: list medical-in denied tcp 192.168.216.4(60715) -\> 10.11.12.100(6812), 5 packets ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 4, 2018, 7:46pm UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/2 "2018-09-04T19:46:39Z")
It's not clear exactly what you're asking, but it sounds like you want to keep only some of the messages. Which messages are wanted and which are unwanted? ---
**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\ **Post date:** [September 4, 2018, 9:14pm UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/3 "2018-09-04T21:14:33Z")
Sorry i may be mentioned wrong and confused here. Lets explain detailed here I have raw log storing in from all the devices each vendor send in different format Like VPX Sep 1 14:40:33 VPX-02 09/01/2018:13:40:33 GMT VPX-02 0-PPE-0 : default API CMD\_EXECUTED 523995 0 : User nsroot - Remote\_ip 192.168.255.47 - Command "stat ns" - Status "Success" Sep 1 14:40:33 VPX-01 09/01/2018:13:40:33 GMT VPX-01 0-PPE-0 : default API CMD\_EXECUTED 525164 0 : User nsroot - Remote\_ip 192.168.255.47 - Command "stat ns" - Status "Success" IAS Switch Sep 1 14:40:34 SWIAS02 7187590: Sep 1 14:40:33.081 BST: %ILPOWER-5-IEEE\_DISCONNECT: Interface Fa1/0/39: PD removed Sep 1 14:43:41 SITEIAS01 599982: Sep 1 14:43:40.604 BST: %ADJ-5-RESOLVE\_REQ\_FAIL: Adj resolve request failed for 10.188.98.231 on Vlan498 Branch Switch Sep 1 14:43:42 BRANCH01 BST: %PLATFORM\_STACKPOWER-4-REDUNDANCY\_LOSS: Switch 1's power stack lost redundancy and is now operating in power sharing mode Sep 1 14:43:42 BRANCH2 1025166: Sep 1 14:43:41.893 BST: %SEC-6-IPACCESSLOGP: list medical-in denied tcp 192.168.216.4(60715) -\> 10.11.12.100(6812), 5 packets I would like to have output Date, Device\_src, message as example below - Sep 1 14:40:33 VPX-02 default API CMD\_EXECUTED 523995 0 : User nsroot - Remote\_ip 192.168.255.47 - Command "stat ns" - Status "Success" Sep 1 14:40:34 SWIAS02 %ILPOWER-5-IEEE\_DISCONNECT: Interface Fa1/0/39: PD removed Sep 1 14:43:42 BRANCH01 %SEC-6-IPACCESSLOGP: list medical-in denied tcp 192.168.216.4(60715) -\> 10.11.12.100(6812), 5 packets hope this make sense i guess ? appreciate your help. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 5, 2018, 8:55am UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/4 "2018-09-05T08:55:38Z")
Use a grok filter to parse your logs and extract the fields you want. The filter can list multiple grok expressions (each one matching the logs from a particular kind of device) that'll be tried in order until there's a match. ---
**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\ **Post date:** [September 5, 2018, 9:24pm UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/5 "2018-09-05T21:24:02Z")
Appreciate if you can point me some example, i was try to find in forum and docs, may be missing some direction here.. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 6, 2018, 6:17am UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/6 "2018-09-06T06:17:41Z")
See [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html). The grok filter documentation contains an example of how to list multiple grok expressions: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match) ---
**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\ **Post date:** [September 6, 2018, 6:03pm UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/7 "2018-09-06T18:03:23Z")
Thank you let me look and get back here any issue. Appreciate your inputs ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2018, 6:03pm UTC](https://discuss.elastic.co/t/how-can-sort-assorted-logs-to-steam-line-logs/146943/8 "2018-10-04T18:03:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.