# Java Logs patterns
**URL:** https://discuss.elastic.co/t/java-logs-patterns/102996
**Category:** Logstash
**Created:** [October 6, 2017, 11:20am UTC](https://discuss.elastic.co/t/java-logs-patterns/102996 "2017-10-06T11:20:22Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mbvelo](https://discuss.elastic.co/u/mbvelo)
#### Post date: [October 6, 2017, 11:20am UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/1 "2017-10-06T11:20:23Z")
please advice - is this format correct to review structured java log?
input {
beats {
port =\>5044
}
}
output {
elasticsearch {
hosts =\> "localhost:9200"
manage\_template =\> false
index =\> ["NUMBER:thread", "message", "%{TIMESTAMP\_ISO8601:logdate} %{LOGLEVEL:loglevel} (?.\*)"]
document\_type =\> "%{[@metadata][type]}"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 6, 2017, 11:27am UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/2 "2017-10-06T11:27:39Z")
No. You've somehow conflated the grok filter and the elasticsearch output. For now I suggest you leave the `index` option alone entirely and that you add a grok filter. Your match expression doesn't look completely unreasonable (depending on what the log looks like; there's no standard format for Java application logs).
---
### Author:  [@mbvelo](https://discuss.elastic.co/u/mbvelo)
#### Post date: [October 6, 2017, 11:43am UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/3 "2017-10-06T11:43:35Z")
Thanks
please assist with this one , please bare with me still a newbie in ELK
**I am trying to get - pattern : Thread\>\>Message\>\>LogLevel**
input{
beats{
port=\>5044
type=\>"\*.log"
codec=\>
multiline{
charset=\>"ISO-8859-1"
pattern=\>"^%{TIMESTAMP\_ISO8601}"
max\_lines=\>1000
negate=\>true
what=\>"previous"
}
}
}filter{
mutate{
gsub=\>["message","\r",""]
}grok{
patterns\_dir=\>"./patterns"
match =\> { message =\> ["%{TIMESTAMP\_ISO8601:timestamp}","%{LOGLEVEL1:loglevel}","%{SKYEXCEPTION\_TYPE:exception}"]}
}date{
match=\>["timestamp","yyyy-MM-dd HH:mm:ss,SSS"]
remove\_field=\>["timestamp"]
}
}output{
elasticsearch{
hosts=\>"localhos:9200"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 6, 2017, 12:29pm UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/4 "2017-10-06T12:29:01Z")
> I am trying to get - pattern : Thread\>\>Message\>\>LogLevel
I don't know what you mean by this. It would be easier to help if we knew what your messages look like.
General comments:
- Perform multiline processing on the Beats side. Don't do it in Logstash.
- The hostname in the elasticsearch `hosts` option is misspellt.
- You're listing three different grok expressions in your grok filter. Don't do that; write a single grok expression that captures everything you want.
- To avoid surprises use an absolute path to the pattern file in the grok filter.
---
### Author:  [@mbvelo](https://discuss.elastic.co/u/mbvelo)
#### Post date: [October 6, 2017, 12:42pm UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/5 "2017-10-06T12:42:59Z")
I am trying to get - pattern : Thread\>\>Message\>\>LogLevel
i want my kibana to display / visualize my logs in this fashion - Thread.message.loglevel.date
---
### Author:  [@mbvelo](https://discuss.elastic.co/u/mbvelo)
#### Post date: [October 6, 2017, 12:59pm UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/6 "2017-10-06T12:59:00Z")
can you send me default configs and beats configs
1. logstash.conf
2. logstash.yml
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 6, 2017, 1:16pm UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/7 "2017-10-06T13:16:40Z")
> I am trying to get - pattern : Thread\>\>Message\>\>LogLevel
As I said, I don't understand what you mean by this. Instead of describing what you want to do please use concrete examples. What does a log message look like? Which fields do you want in Kibana?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 3, 2017, 1:16pm UTC](https://discuss.elastic.co/t/java-logs-patterns/102996/8 "2017-11-03T13:16:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.