# How to parse different log in logstash configuration

**URL:** <https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142>\
**Category:** Logstash\
**Created:** [October 7, 2021, 1:49pm UTC](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142 "2021-10-07T13:49:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roccof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roccof97/32/97628_2.png) [@Roccof97](https://discuss.elastic.co/u/Roccof97)\
**Post date:** [October 7, 2021, 1:49pm UTC](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142/1 "2021-10-07T13:49:56Z")

</div>

Hello to all,

i have a problem with activemq logos i have created different types of grok,  
but the problem is that sometimes the message is different with additional fields  
and consequently it is parsed incorrectly, is there a way to parse dynamically?  
Are there any alternative methods to Grok?  
I would be interested in parsing the fields, Timestamp, Evet\_type (INFO, WARN, ERROR), Event, action, Username.

Log example:

2021-10-07 13:38:47,157 | INFO | [#id:xxXXXXXX] [#event:done pass control to super.addConnection(context,info)] [#arg:action:addDestination] [#arg:username:CCCCCCC] [#arg:client-id:ID:CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC] [#arg:connection-id:ID:CCCCCCCCCCCCCCCCCCCCCCCCCC] [#arg:destination:topic://CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC | ActiveMQ Transport: tcp:///127.0.0.1:57140@61616

2021-10-07 13:38:47,140 | INFO | [#id:xxxxxx] [#event:doing pass control to super.addConnection(context,info)] [#arg:username:xxxxxxx] [#arg:client-id:ID:xxxxxxxxxxxxxxxxxxxxxxxxxxxx] [#arg:client-ip:tcp://127.0.0.1:57140] [#arg:connection-id:ID:xxxxxxxxxxxx.xxxxxxxxx.xxxxx.xxxxxxxx] | xxxxxxxxxxx.xxxxxxxxx.xxxxxxxxx.xxxxxxx.xxxx| ActiveMQ Transport: tcp:///127.0.0.1:57140@61616

These are just two examples but there are many other different ones.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 7, 2021, 3:43pm UTC](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142/2 "2021-10-07T15:43:19Z")

</div>

Not sure how dynamic all your logs are but have you tried doing it this way?

```auto
filter {
 grok {
  break_on_match => false
  match => { "message" => "^%{TIMESTAMP_ISO8601:timestamp} | %{LOGLEVEL:loglevel} |" }
  match => { "message" => "event:%{DATA:event}]" }
  match => { "message" => "action:%{DATA:action}]" }
  match => { "message" => "username:%{DATA:username}]" }
 } 
} 

```

---

<div class="post-metadata">

**Author:** ![Roccof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roccof97/32/97628_2.png) [@Roccof97](https://discuss.elastic.co/u/Roccof97)\
**Post date:** [October 8, 2021, 7:47am UTC](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142/3 "2021-10-08T07:47:16Z")

</div>

Hi Aaron,

thanks for your help, it works!

Thank you very much

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2021, 7:47am UTC](https://discuss.elastic.co/t/how-to-parse-different-log-in-logstash-configuration/286142/4 "2021-11-05T07:47:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.