# How to define the patterns for filters in logstash
**URL:** https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150
**Category:** Logstash
**Created:** [November 9, 2015, 1:10pm UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150 "2015-11-09T13:10:39Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@shravankodipaka](https://discuss.elastic.co/u/shravankodipaka)
#### Post date: [November 9, 2015, 1:10pm UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/1 "2015-11-09T13:10:39Z")
Hi all,
I am new to Logstash, I've just set up a new ELK-stack for analyzing of Tomcat and EC2 instance logs in Kibana.
For this how to define the patterns and how to configure custom patterns in logstash.conf file... plz help me.....
Advance thanks,
Shravan K.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 9, 2015, 2:21pm UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/2 "2015-11-09T14:21:40Z")
You'll want to use the [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) for this. Have you read its documentation, including the section on custom patterns?
---
### Author:  [@shravankodipaka](https://discuss.elastic.co/u/shravankodipaka)
#### Post date: [November 10, 2015, 5:22am UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/3 "2015-11-10T05:22:28Z")
Hi mag, thank you for reply...
Yes i want to use grok filter for this...
Just explain little deeply how to do the custom patterns/filters for this please...
Thanks,
Shravan K.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 10, 2015, 6:34am UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/4 "2015-11-10T06:34:26Z")
If you ask concrete questions I will attempt to answer them, but I won't write about things that are already documented. If you don't understand the documentation then please ask questions about the parts that you don't understand.
---
### Author:  [@shravankodipaka](https://discuss.elastic.co/u/shravankodipaka)
#### Post date: [November 10, 2015, 7:30am UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/5 "2015-11-10T07:30:21Z")
thank you mag,
Please share that document.. or any other related links for this.
Thanks,
Shravan K.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 10, 2015, 7:42am UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/6 "2015-11-10T07:42:41Z")
I pointed you to the grok documentation in my last post!
The Logstash documentation also contains a couple of complete configuration examples that you should be able to find easily.
---
### Author:  [@shravankodipaka](https://discuss.elastic.co/u/shravankodipaka)
#### Post date: [November 10, 2015, 8:17am UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/7 "2015-11-10T08:17:17Z")
Hi Mag,
below is my logstash.conf file. Am given the tomcat log and default patterns path..
Now i want to filter the tomcat log file,
If any changes are required in this code please inform to me where i need to change the code...
its my logstash.conf file
###########################################
input
{
file
{
path =\> "/usr/share/apache-tomcat-8.0.23/logs/_.log"
type =\> "logs"
start\_position =\> "beginning"
}
}
filter {
if [type] == "logs" {
grok {
patterns\_dir =\> "/opt/ELK/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns"
match =\> ["message", "[%{TIMESTAMP\_ISO8601:timestamp}][%{DATA:severity}%{SPACE}][%{DATA:source}%{SPACE}]%{SPACE}[%{DATA:node}]%{SPACE}(?(.|\r|\n)_)" ]
}
date {
match =\> ["timestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
}
}
}
output
{
elasticsearch
{
host =\> "localhost"
protocol =\> "http"
port =\> "9200"
}
}
Its my kibana output:
@timestamp November 10th 2015, 07:41:37.307
t@version1 t\_id AVDwV9CJ6v7rE3-RskI1
t\_index logstash-2015.11.10
t\_type logs
thost ip-10-129-52-27.apsoutheast-.compute.internal
tmessage 09-Nov-2015 00:55:32.678 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in 21808 ms
tpath /usr/share/apache-tomcat-8.0.23/logs/catalina.2015-11-09.log
ttags grokparsefailure
\_
ttype logs
Thanks,
Shravan K,
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 10, 2015, 12:09pm UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/8 "2015-11-10T12:09:00Z")
I think you'll find [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/) and [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) useful for experimenting and learning how to write grok expressions.
One immediate problem with your current expression is that you're not escaping the square brackets (which have a special meaning in regular expressions). To avoid surprises I also suggest that you avoid using more than one DATA pattern in the same expression.
---
### Author:  [@shravankodipaka](https://discuss.elastic.co/u/shravankodipaka)
#### Post date: [November 11, 2015, 9:40pm UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/9 "2015-11-11T21:40:01Z")
Hi Mag,
I need to get the info regarding patterns/filters for Heap-dump, memory leak and any exception.. etc in Tomcat log.
Could you please review my query also help me regarding this.
Thanks,
Shravan K,
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 11, 2015, 9:42pm UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/10 "2015-11-11T21:42:48Z")
If you post a question I might be able to help. Clear questions with input, expected output, and a minimal configuration sample will improve the chances.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/how-to-define-the-patterns-for-filters-in-logstash/34150/11 "2017-07-06T05:23:08Z")