# I want to create grok pattern for custom log

**URL:** <https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143>\
**Category:** Logstash\
**Created:** [April 8, 2020, 1:58pm UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143 "2020-04-08T13:58:32Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [April 8, 2020, 1:58pm UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/1 "2020-04-08T13:58:33Z")

</div>

Hi,  
Following is a log-pattern and I tried creating one but it didn't work.

Log:

```auto
2020-04-07	00:00:02	Local0	Info	00:00:01:911	DMSTST-TBOX.DEV.cloud.companyname.com	DEV\DMSTST-TBOX$|17352|DICOM Service	VMSDBD_SVC_DICOM	008940/Remote Implementation Class UID: '1.2.276.0.7230010.3.0.3.6.3', Implementation Version Name: 'OFFIS_DCMTK_363'

```

Pattern:

```auto
%{TIMESTAMP_ISO8601:date} \t %{KEYWORD:typedata} %{KEYWORD:loglevel} %{GREEDYDATA} %{KEYWORD:host} %{KEYWORD:serviceinfo} %{KEYWORD:component} %{TEXT:messagefield}

```

Can anyone help me with this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 8, 2020, 2:13pm UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/2 "2020-04-08T14:13:34Z")

</div>

How have you defined the KEYWORD pattern?

---

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [April 8, 2020, 2:27pm UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/3 "2020-04-08T14:27:36Z")

</div>

I am using KEYWORD as datatype mapping.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 8, 2020, 4:02pm UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/4 "2020-04-08T16:02:30Z")

</div>

A grok pattern and an elasticsearch mapping are unrelated concepts.

---

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [April 9, 2020, 4:16am UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/5 "2020-04-09T04:16:26Z")

</div>

I just want to create grok for tab separated field but I don't know ho to do that...even I tried with grok constructor but seems tab is not working.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 9, 2020, 2:42pm UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/6 "2020-04-09T14:42:31Z")

</div>

> [@Atul\_Gunjal](#):
>
> I just want to create grok for tab separated field

You can just use a literal tab in the pattern.

---

<div class="post-metadata">

**Author:** ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\
**Post date:** [April 16, 2020, 10:19am UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/7 "2020-04-16T10:19:15Z")

</div>

```auto
%{TIMEFORMAT:eventtime}\t%{WORD:typedata}\t%{WORD:loglevel}\t%{GREEDYDATA}\t%{GREEDYDATA:host}\t%{SERVMSG}

```

```auto
TIMEFORMAT %{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{TIME}
SERVMSG %{GREEDYDATA:serviceinfo}\t\t%{GREEDYDATA:message}|%{GREEDYDATA:message}

```

works well.  
Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2020, 10:19am UTC](https://discuss.elastic.co/t/i-want-to-create-grok-pattern-for-custom-log/227143/8 "2020-05-14T10:19:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.