# Is there an Application for Semi-Automatic Grok Construction? **URL:** \ **Category:** Logstash\ **Created:** [September 18, 2017, 5:37pm UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908 "2017-09-18T17:37:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jeff\_Kubina](https://avatars.discourse-cdn.com/v4/letter/j/ecd19e/32.png) [@Jeff\_Kubina](https://discuss.elastic.co/u/Jeff_Kubina)\ **Post date:** [September 18, 2017, 5:37pm UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908/1 "2017-09-18T17:37:43Z")
As best I can tell there does not seem to be a tool or application that will in a semi-automatically, or in a semi-supervised manner, derive grok patterns from a large collection of log messages. I think such a tool would be really helpful in speeding up the ingestion of new sources of log messages. I think it would also help speed up the creation of charts in Kibana. Briefly, I would want the system to 1) statistically analyze millions of log messages, 2) cluster them based on the template used to generate the log messages, 3) suggest groks for each of the clusters, 4) have a user interface to test, analyze, and tune the suggested groks, and 5) have a way to automatically deploy and/or revert the new groks. Does anyone know of such an application? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 18, 2017, 10:44pm UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908/2 "2017-09-18T22:44:17Z")
There is [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/), I can't comment on how effective it is though. ---
**Author:** ![Jeff\_Kubina](https://avatars.discourse-cdn.com/v4/letter/j/ecd19e/32.png) [@Jeff\_Kubina](https://discuss.elastic.co/u/Jeff_Kubina)\ **Post date:** [September 18, 2017, 11:52pm UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908/3 "2017-09-18T23:52:39Z")
Grok Constructor is for building a grok manually from a small set of log messages that are from the same template (cluster). A nice tool but not what I am looking for. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 19, 2017, 12:13am UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908/4 "2017-09-19T00:13:38Z")
That's pretty much it at the moment. ---
**Author:** ![Jeff\_Kubina](https://avatars.discourse-cdn.com/v4/letter/j/ecd19e/32.png) [@Jeff\_Kubina](https://discuss.elastic.co/u/Jeff_Kubina)\ **Post date:** [September 19, 2017, 12:41pm UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908/5 "2017-09-19T12:41:34Z")
Ok, that's what I thought. I will post a RFC to see if there is much interest in developing such a tool/application. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 19, 2017, 9:11pm UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908/6 "2017-09-19T21:11:52Z")
I think there would be quite a lot of interest 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 17, 2017, 9:11pm UTC](https://discuss.elastic.co/t/is-there-an-application-for-semi-automatic-grok-construction/100908/7 "2017-10-17T21:11:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.