# How do parse log format apache tomcat

**URL:** <https://discuss.elastic.co/t/how-do-parse-log-format-apache-tomcat/341529>\
**Category:** Logstash\
**Created:** [August 24, 2023, 3:52am UTC](https://discuss.elastic.co/t/how-do-parse-log-format-apache-tomcat/341529 "2023-08-24T03:52:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vanhaiit90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vanhaiit90/32/119189_2.png) [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)\
**Post date:** [August 24, 2023, 3:52am UTC](https://discuss.elastic.co/t/how-do-parse-log-format-apache-tomcat/341529/1 "2023-08-24T03:52:17Z")

</div>

Good moring everyone!

I have a log with the format of the tomcat access log service (localaccesslog.txt)

> 10.0.xx.xx [22/Aug/2023:00:00:30 +0700] "GET /zkau?dtid=z\_qe0&cmd\_0=rmDesktop&opt\_0=i HTTP/1.0" 200 17 0

Now I want parse text log above and insert to grok in the Ingest Pipelines. I tries configure grok with devtool but it is seem not ok. Please help me to solve the problem quickly

---

<div class="post-metadata">

**Author:** ![Ljapunov](https://avatars.discourse-cdn.com/v4/letter/l/f4b2a3/32.png) [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\
**Post date:** [August 24, 2023, 6:59am UTC](https://discuss.elastic.co/t/how-do-parse-log-format-apache-tomcat/341529/2 "2023-08-24T06:59:03Z")

</div>

maybe this is a pattern you can start working with:

```auto
%{IPORHOST:ip} \[%{HTTPDATE:date}\] \"%{WORD:method} %{DATA:request} %{PROG:protocol}\" %{NUMBER:returncode} %{NUMBER:size} %{NUMBER:responsetime}

```

---

<div class="post-metadata">

**Author:** ![vanhaiit90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vanhaiit90/32/119189_2.png) [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)\
**Post date:** [August 24, 2023, 7:36am UTC](https://discuss.elastic.co/t/how-do-parse-log-format-apache-tomcat/341529/3 "2023-08-24T07:36:39Z")

</div>

> [@Ljapunov](#):
>
> `%{IPORHOST:ip} \[%{HTTPDATE:date}\] \"%{WORD:method} %{DATA:request} %{PROG:protocol}\" %{NUMBER:returncode} %{NUMBER:size} %{NUMBER:responsetime}`

Thank Bro. I Just try and successful

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2023, 7:36am UTC](https://discuss.elastic.co/t/how-do-parse-log-format-apache-tomcat/341529/4 "2023-09-21T07:36:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.