# Ingesting Mainframe logs

**URL:** <https://discuss.elastic.co/t/ingesting-mainframe-logs/115087>\
**Category:** Logstash\
**Created:** [January 11, 2018, 12:31pm UTC](https://discuss.elastic.co/t/ingesting-mainframe-logs/115087 "2018-01-11T12:31:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sajeew.Ganesh](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sajeew.Ganesh](https://discuss.elastic.co/u/Sajeew.Ganesh)\
**Post date:** [January 11, 2018, 12:31pm UTC](https://discuss.elastic.co/t/ingesting-mainframe-logs/115087/1 "2018-01-11T12:31:41Z")

</div>

Hi,

Im looking to work on mainframe logs. i am looking for help. can anyone assist how to ingest mainframe logs to logstash.  
The sample logs are as below.

N 0000000 T158 2017208 23:59:00.24 00000281 IEF196I IEF237I JES2 ALLOCATED TO SYSLOG43  
N 0000000 T158 2017208 23:59:00.26 00000281 IEF196I IEF285I +MASTER+.SYSLOG.STC50978.D0000143.? SYSOUT  
X 0000000 T158 2017208 23:59:00.27 SYSLOG 00000000 IEE042I SYSTEM LOG DATA SET INITIALIZED  
N 4000000 T158 2017208 23:59:00.26 00000291 IEE043I A SYSTEM LOG DATA SET HAS BEEN QUEUED TO SYSOUT CLASS M  
N 8000000 T158 2017208 23:59:00.34 STC50980 00000290 MTR022I BEGIN AUTOMATED RULE FOR MSG MVS#IEE043I  
N 8000000 T158 2017208 23:59:00.34 STC50980 00000290 MTR022I BEGIN AUTOMATED RULE FOR TOD TODH0#MQOPER  
N 8000000 T158 2017208 23:59:00.35 STC50980 00000290 MTR027I ISSUING OPER COMMAND FOR TOD TODH0#MQOPER  
N 8000000 T158 2017208 23:59:00.35 STC50980 00000290 MTR027I ISSUING OPER COMMAND FOR MSG MVS#IEE043I

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 23, 2018, 9:04pm UTC](https://discuss.elastic.co/t/ingesting-mainframe-logs/115087/2 "2018-01-23T21:04:41Z")

</div>

Use a grok filter. If you're unfamiliar with regular expressions the grok constructor web site could be helpful.

---

<div class="post-metadata">

**Author:** ![Sajeew.Ganesh](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sajeew.Ganesh](https://discuss.elastic.co/u/Sajeew.Ganesh)\
**Post date:** [February 5, 2018, 10:21am UTC](https://discuss.elastic.co/t/ingesting-mainframe-logs/115087/3 "2018-02-05T10:21:56Z")

</div>

Thanks.  
Yes. It worked. Now actually what i feel as a challenge is how could the mainframe log be converted as a normal time stamp. Where there is Julian Date in Mainframe logs. will logstash convert it or any specific tags to be written?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 5, 2018, 1:43pm UTC](https://discuss.elastic.co/t/ingesting-mainframe-logs/115087/4 "2018-02-05T13:43:34Z")

</div>

Have a look at this thread: [Need Help in converting Julian date in to Calender date](https://discuss.elastic.co/t/need-help-in-converting-julian-date-in-to-calender-date/44140)

---

<div class="post-metadata">

**Author:** ![Sajeew.Ganesh](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sajeew.Ganesh](https://discuss.elastic.co/u/Sajeew.Ganesh)\
**Post date:** [February 6, 2018, 9:31am UTC](https://discuss.elastic.co/t/ingesting-mainframe-logs/115087/5 "2018-02-06T09:31:35Z")

</div>

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 9:31am UTC](https://discuss.elastic.co/t/ingesting-mainframe-logs/115087/6 "2018-03-06T09:31:43Z")

</div>

Closed on March 6, 2018, 9:31am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.