# How to Parse logfile with columns informations
**URL:** https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699
**Category:** Logstash
**Created:** [August 2, 2018, 7:28am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699 "2018-08-02T07:28:12Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Loudone](https://discuss.elastic.co/u/Loudone)
#### Post date: [August 2, 2018, 7:28am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/1 "2018-08-02T07:28:12Z")
Dear All,
I'm trying to parse a very specific Log, this log look like this:
```
pid user_name user_authentication client_host client_lib_ver
=== ========= =================== =========== ==============
510 dmadmin Password 0111APPT 5.3.0.622 SP6
378 dmadmin Password ADTS71 7.1.0450.0357
464 dmadmin Password ADTS71 7.1.0450.0357
410 dmadmin Trusted Client DCTMLS20 7.3.0030.0023
307 dmadmin Trusted Client DCTMLS20 7.3.0040.0025
432 Aodren LE Ticket 0112APPT 7.2.0000.0054
338 Aodren LE Ticket 0112APPT 7.2.0000.0054
688 Aodren LE Ticket 0112APPT 7.2.0000.0054
```
My question is: how can I parse in logstash with grok filter this kind of log? and is it possible?
Many thanks for your feed Back
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 2, 2018, 7:44am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/2 "2018-08-02T07:44:18Z")
Of course it's possible, but using a csv or dissect filter might be easier. Are columns always separated by two or more spaces, i.e. how do we know that "Aodren LE" is part of the same column?
---
### Author:  [@Loudone](https://discuss.elastic.co/u/Loudone)
#### Post date: [August 2, 2018, 8:10am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/3 "2018-08-02T08:10:47Z")
Hello Magnus,
To begin, Thank you for your response.
I'm completly agree with you, if this log will be in csv, it could be an easier way.
Every columns are separated by two spaces, and for the column User\_name, the string is include in the length of the multiple string "=" on the top of the log
If it's possible to do that with the dissect filter, how can I do that?
Thank you
---
### Author:  [@Loudone](https://discuss.elastic.co/u/Loudone)
#### Post date: [August 2, 2018, 8:53am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/4 "2018-08-02T08:53:56Z")
Magnus, do you have an idea.?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 2, 2018, 9:14am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/5 "2018-08-02T09:14:02Z")
This example from the documentation is pretty close to what you need: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html#\_delimiters\_used\_as\_padding\_to\_visually\_align\_fields](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html#_delimiters_used_as_padding_to_visually_align_fields)
---
### Author:  [@Loudone](https://discuss.elastic.co/u/Loudone)
#### Post date: [August 2, 2018, 10:05am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/6 "2018-08-02T10:05:38Z")
Magnus,
it seems to be interresting!! many thanks for your feed back
---
### Author:  [@Loudone](https://discuss.elastic.co/u/Loudone)
#### Post date: [August 2, 2018, 10:15am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/7 "2018-08-02T10:15:08Z")
Last question Magnus, do you hnow if Dissect Debugger similar to the grok debugger exit?
it's very helpful for debugging logstash config
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 2, 2018, 10:54am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/8 "2018-08-02T10:54:50Z")
> Last question Magnus, do you hnow if Dissect Debugger similar to the grok debugger exit?
I don't believe there's anything like that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2018, 10:54am UTC](https://discuss.elastic.co/t/how-to-parse-logfile-with-columns-informations/142699/9 "2018-08-30T10:54:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.