# How processing logs with different structure with logstash
**URL:** https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401
**Category:** Logstash
**Created:** [July 23, 2020, 8:46pm UTC](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401 "2020-07-23T20:46:14Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Bilal2](https://discuss.elastic.co/u/Bilal2)
#### Post date: [July 23, 2020, 8:46pm UTC](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401/1 "2020-07-23T20:46:14Z")
Hi, I'm fairly new to logstash; and I want to ship the logs to elasticsearch but I have different structures of logs in my log file:
such as:
**00000078 1 57118 20200708040053402 6408 2 admin [IP-AC1FF2CB.io](http://IP-AC1FF2CB.io) rsession21.exe ( Analytics ) 01F210039n 21.0.58.0 0 QI=57123**
**00000029 2 9895145 20200723131147294 1 QI=57523**
My filter:
filter
{
grok{
match =\> {
"message" =\> "%{NUMBER:COL\_01}%{SPACE}%{NUMBER:COL\_02}%{SPACE}%{NUMBER:COL\_03}%{SPACE}%{NUMBER:COL\_04}%{SPACE}%{DATA:COL\_05}%{SPACE}%{USERNAME:COL\_06}%{SPACE}%{USERNAME:COL\_07} (?\[^{]\*)%{SPACE}%{IP:COL\_09}%{SPACE}%{NUMBER:COL\_10}%{SPACE}%{GREEDYDATA:COL\_11}"
}
}
}
I created a filter that able to filtering the first structure, but for the second structure it is not be able, and I receive this log in elasticsearch as a message, cause the filter is not adapted.
Now my question is how to create a standard filter for all logs.
Thank you
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 23, 2020, 9:47pm UTC](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401/2 "2020-07-23T21:47:46Z")
If you log entries have a standard prefix then I would [normally](https://discuss.elastic.co/t/using-grok-how-to-parse-multiple-entries-with-the-same-field-name/184819/2) suggest picking that off with dissect, then using grok against the various formats of the log.
In this case I would consider doing it with a csv filter.
```
csv { separator => " " columns => ["COL_01", "COL_02", "COL_03", "COL_04", "[@metadata][restOfLine]" }
```
Then use grok with an array of pattern to match [@metadata][restOfLine]
---
### Author:  [@Bilal2](https://discuss.elastic.co/u/Bilal2)
#### Post date: [July 27, 2020, 4:44pm UTC](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401/3 "2020-07-27T16:44:48Z")
Thanks!! This helps 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 24, 2020, 4:49pm UTC](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401/4 "2020-08-24T16:49:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.