# How to parse Elasticsearch logs?
**URL:** https://discuss.elastic.co/t/how-to-parse-elasticsearch-logs/41029
**Category:** Logstash
**Created:** [February 5, 2016, 8:01am UTC](https://discuss.elastic.co/t/how-to-parse-elasticsearch-logs/41029 "2016-02-05T08:01:17Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)
#### Post date: [February 5, 2016, 8:01am UTC](https://discuss.elastic.co/t/how-to-parse-elasticsearch-logs/41029/1 "2016-02-05T08:01:17Z")
I have an elasticsearch log and one line from that looks like this:
[2016-02-02 00:03:17,558][INFO][cluster.service] [Sugar Man] added {[factordb-d0b9dfee4570f86e--3b3c30d8-1529e1c2cec--8000][5ayv3rbgQT6AK7iWoy3u7g][fc-machine][inet[/192.168.2.9:9301]]{data=false, master=false},}, reason: zen-disco-receive(join from node[[factordb-d0b9dfee4570f86e--3b3c30d8-1529e1c2cec--8000][5ayv3rbgQT6AK7iWoy3u7g][fc-machine][inet[/192.168.2.9:9301]]{data=false, master=false}])
Can anyone help me to find the grok pattern for this line?
Thanks!
---
### Author:  [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)
#### Post date: [February 5, 2016, 8:20am UTC](https://discuss.elastic.co/t/how-to-parse-elasticsearch-logs/41029/2 "2016-02-05T08:20:32Z")
I already found the answer:
```
match => { "message"=> "\[%{TIMESTAMP_ISO8601:log_timestamp}\]\[%{DATA:log_level}%{SPACE}\]\[%{DATA:source}%{SPACE}\]%{SPACE}\[%{DATA:node}\]%{SPACE}%{GREEDYDATA:log_message}"}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 5, 2016, 8:22am UTC](https://discuss.elastic.co/t/how-to-parse-elasticsearch-logs/41029/3 "2016-02-05T08:22:15Z")
Watch out for multiple DATA and GREEDYDATA patterns in the same expression. You might get surprising matches.
---
### Author:  [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)
#### Post date: [February 5, 2016, 11:40am UTC](https://discuss.elastic.co/t/how-to-parse-elasticsearch-logs/41029/4 "2016-02-05T11:40:16Z")
I tested the filter and it worked just fine. Thanks for the advice though Mr. @magnusbaeck 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/how-to-parse-elasticsearch-logs/41029/5 "2017-07-06T05:12:54Z")