/logstash-all-plugins-2.4.0/logstash-2.4.0/patterns"
match => ["message","%{WEBLOGIC_POC}|%{WEBLOGIC_POC1}"]
}
date {
match => ["timestamp","EEE MMM dd HH:mm:ss z yyyy"]
}
}
if [type] == "access" {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
date {
match => ["timestamp","EEE MMM dd HH:mm:ss z yyyy"]
}
}
}
output {
if [type] == "application" {
elasticsearch {
hosts => ["localhost:9200"]
index => "prod_logs_data-%{+YYYY.MM.dd}"
}
}
if [type] == "access"{
elasticsearch {
hosts => ["localhost:9200"]
index => "prod_accesslogs_data-%{+YYYY.MM.dd}"
}
}
}`Preformatted text`
```
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 14, 2016, 7:05am UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/2 "2016-09-14T07:05:04Z")
Please format your code with the `` button, it’s very hard to read as it is.
---
### Author:  [@dvkawa](https://discuss.elastic.co/u/dvkawa)
#### Post date: [September 14, 2016, 7:09am UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/3 "2016-09-14T07:09:11Z")
Does it look better?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 14, 2016, 8:54am UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/4 "2016-09-14T08:54:38Z")
What isn't working?
---
### Author:  [@dvkawa](https://discuss.elastic.co/u/dvkawa)
#### Post date: [September 14, 2016, 8:59am UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/5 "2016-09-14T08:59:45Z")
Hi, Looks like its not able to understand the two file inputs, its reading the second file - ecomm\_vws02\_access.201609121200 alone and creating only-prod\_logs\_data-%{+YYYY.MM.dd} index, with gorkparse failure and not creating the second index -prod\_accesslogs\_data-\*
Please advice, thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 14, 2016, 9:27am UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/6 "2016-09-14T09:27:22Z")
Is it reading the other file at all? I suggest you disable the (somewhat) working file input and focus debugging on what doesn't work at all and then fix one thing at a time. This will be easier to debug if you replace the elasticsearch outputs with a single `stdout { codec => rubydebug }` output.
---
### Author:  [@dvkawa](https://discuss.elastic.co/u/dvkawa)
#### Post date: [September 14, 2016, 12:22pm UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/7 "2016-09-14T12:22:29Z")
Thanks Magnus - But the issue is, if I specify a single input location, it works perfectly well. But If i place both types of logs in the input directory, it reads the FIRST one ONLY. Second file isnt getting read at all.Anything wrong in my syntax? Please suggest, its little critical. Many Thanks.`Preformatted text`
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 14, 2016, 12:44pm UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/8 "2016-09-14T12:44:36Z")
I haven't heard of such behavior before. I'd kick the log level to max with `--debug` and use other debugging tools (lsof, strace, ...) if needed. Is it opening both files? Is it reading from both files? Et cetera.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/how-to-parse-different-types-log-files-in-logstash/60462/9 "2017-07-06T04:38:31Z")