# How to index inconstant log delimted with tabs

**URL:** <https://discuss.elastic.co/t/how-to-index-inconstant-log-delimted-with-tabs/114050>\
**Category:** Logstash\
**Created:** [January 4, 2018, 9:29am UTC](https://discuss.elastic.co/t/how-to-index-inconstant-log-delimted-with-tabs/114050 "2018-01-04T09:29:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![d4n](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@d4n](https://discuss.elastic.co/u/d4n)\
**Post date:** [January 4, 2018, 9:29am UTC](https://discuss.elastic.co/t/how-to-index-inconstant-log-delimted-with-tabs/114050/1 "2018-01-04T09:29:22Z")

</div>

Hi All,

Im doing POC in my company of ELK stack i dont have issue with parsing iis logs for example but one of our apps have really poor inconstant txt log without headers.

Example:

```auto
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	InitFactory client info:exwhh1s2ofneggxlpuvgg1fc|46.248.188.222|Zabbix|https://sr.cinemacity.sk/SalesSK_res/default.aspx?key=SKPolusP_RES
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	WebTixsExtendedTemplateTicketExportCodes: RT3D,CM
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	WebTixsExtendedTemplateWildcardCode: RT3D
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Creating InitData Semaphore Lock...
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Semaphore WSTixsInit Starting Lock wait One...SMWSTixsInit_/SalesSK_res
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Semaphore WSTixsInit Entered
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Semaphore WSTixsInit Releasing...1106-1011-15
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Semaphore WSTixsInit Released 1106-1011-15
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	InitData completed 1106-1011-15
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	InitFactory, TSEC:eCommerce, TSID:5,SeatLockInSeconds:900
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Init Transaction Provider...
10:49:37	exwhh1s2ofneggxlpuvgg1fc	Instancing WSTixsTransactionProvider(SoftwareType=50, Timeout=60000, Username=WebPay, Password= ****** )...
10:49:37	exwhh1s2ofneggxlpuvgg1fc	Success (Predefined TicketingServiceCode=eCommerce
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Done Init Transaction Provider...
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Assigned soapTixsUrl (Assigned to DataProvider): http://10.72.6.100/wstixs/wstixs.asmx
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Assigned wsTixsUrl (Assigned to TransactionProvider): http://10.72.6.100/wstixs/wstixs.asmx
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Assigned enterpriseWSTixsUrl (Assigned to EnterpriseProvider): http://10.10.50.60/wstixsSK/wstixs.asmx
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Assigned enterpriseSiteId: 1049
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	Done Factory Constructor...
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	SetStartPageQueryString:key=SKPolusP_RES
10:49:37	exwhh1s2ofneggxlpuvgg1fc	SetAutoFillFields
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	InitBookingType:~/BookingType.aspx?dtticks=636414149771132321&key=SKPolusP_RES
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	SetCurrentOrderItem:
10:49:37	exwhh1s2ofneggxlpuvgg1fc	1106	1011	P: BookingType

```

I would normally split them by tab but as you see the file is inconstant. Could someone please advise ?

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 4, 2018, 1:03pm UTC](https://discuss.elastic.co/t/how-to-index-inconstant-log-delimted-with-tabs/114050/2 "2018-01-04T13:03:33Z")

</div>

You should be able to use grok patterns for that.

See [https://cinhtau.github.io/2017/06/30/optional-fields-in-grok/](https://cinhtau.github.io/2017/06/30/optional-fields-in-grok/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2018, 1:03pm UTC](https://discuss.elastic.co/t/how-to-index-inconstant-log-delimted-with-tabs/114050/3 "2018-02-01T13:03:38Z")

</div>

Closed on February 1, 2018, 1:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.