# How to capture .net error logs with grok

**URL:** <https://discuss.elastic.co/t/how-to-capture-net-error-logs-with-grok/79219>\
**Category:** Logstash\
**Created:** [March 20, 2017, 8:40am UTC](https://discuss.elastic.co/t/how-to-capture-net-error-logs-with-grok/79219 "2017-03-20T08:40:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Radiatelabs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radiatelabs/32/16500_2.png) [@Radiatelabs](https://discuss.elastic.co/u/Radiatelabs)\
**Post date:** [March 20, 2017, 8:40am UTC](https://discuss.elastic.co/t/how-to-capture-net-error-logs-with-grok/79219/1 "2017-03-20T08:40:07Z")

</div>

Hi,

I am new to ELK i am trying to setup grok pattern to capture some .net error logs. The logs look like this :

2017-03-20 17:52:31,020 [00000000-0000-0000-0000-000000000000] ERROR ABC.XYZervices.Logger.Log4NetLogger -  
Error in Path :/Cover.svc/soap  
Raw Url :/Cover.svc/soap  
Message :Cannot access child value on Newtonsoft.Json.Linq.JValue.  
Source :Newtonsoft.Json  
Stack Trace : at Newtonsoft.Json.Linq.JToken.get\_Item(Object key)  
at ABC.XYZervices.DAL.Implementations.CoverDal.getCoverSummary\_ClientDetail(JObject response) in c:\BuildAgent\work\9d7188be1901d649\ABC.XYZ.Services\OCSDAL\Implementations\Cover\CoverDAL.cs:line 774  
at System.Threading.Tasks.Task.Execute()  
TargetSite :Newtonsoft.Json.Linq.JToken get\_Item(System.Object)

2017-03-20 17:52:31,528 [00000000-0000-0000-0000-000000000000] DEBUG ABC.XYZervices.Logger.Log4NetLogger - Calling ODS Service URI - [http://abc.ap-au-kent.auto.ABCnet.ABC.net:9000/GetSecurityV1/Security/?MessageID=00000000-0000-0000-0000-000000000000&AuditID=59651c24-94bb-4cc8-b69f-a352e74ce430&Language=&SourceSystem=&RequestedUserID=ABCNET\eschweig](http://abc.ap-au-kent.auto.ABCnet.ABC.net:9000/GetSecurityV1/Security/?MessageID=00000000-0000-0000-0000-000000000000&AuditID=59651c24-94bb-4cc8-b69f-a352e74ce430&Language=&SourceSystem=&RequestedUserID=ABCNET%5Ceschweig)

The above are the two logs one is error and other is just debug log. Can any one help me how can i capture them with grok, will single pattern work for both error and debug ?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2017, 8:40am UTC](https://discuss.elastic.co/t/how-to-capture-net-error-logs-with-grok/79219/2 "2017-04-17T08:40:19Z")

</div>

Closed on April 17, 2017, 8:40am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.