# JSESSIONID should be seperated

**URL:** <https://discuss.elastic.co/t/jsessionid-should-be-seperated/133701>\
**Category:** Logstash\
**Created:** [May 29, 2018, 2:37pm UTC](https://discuss.elastic.co/t/jsessionid-should-be-seperated/133701 "2018-05-29T14:37:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arpit\_Gulati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arpit_gulati/32/48349_2.png) [@Arpit\_Gulati](https://discuss.elastic.co/u/Arpit_Gulati)\
**Post date:** [May 29, 2018, 2:37pm UTC](https://discuss.elastic.co/t/jsessionid-should-be-seperated/133701/1 "2018-05-29T14:37:22Z")

</div>

I have a log 192.168.23.56 [www.jdomni.com](http://www.jdomni.com) 192.168.23.58 [29/May/2018:04:32:53 +0530] "GET /marketplace/login.service;JDSESSIONID=BF322E7FE8EEC70D66505838E12A486F HTTP/1.1" 302 0 [29/May/2018:04:32:53 +0530] 0.012 0.012 "-" "-" "-" "" "rememberMe="  
and the grok parser that I am using is ...

(?:%{IPORHOST:source\_ip}|-) (?:%{DATA:client\_ip}|-) (?:%{DATA:auth}|-) [%{HTTPDATE:timestamp}] "%{WORD:verb} %{URIPATH:uri}(?:%{DATA:parameters})? HTTP/%{NUMBER:httpversion}" %{NUMBER:response\_code} (?:%{NUMBER:bytes}|-) [%{HTTPDATE:start\_time}] (?:%{NUMBER:request\_time}|-) (?:%{NUMBER:response\_time}|-) "(%{URIPROTO:protocol}://(?:%{IPORHOST:referer\_name})?(?:%{URIPATHPARAM:referer\_uri})?|-)" %{QS:agent} ("%{DATA:post\_data}") ("%{DATA:response}") ("%{DATA:cookie}") but the problem with this is

I am getting URI as /marketplace/login.service;JDSESSIONID=BF322E7FE8EEC70D66505838E12A486F but I don't want Jsession ID with this URI /marketplace/login.service . JSESSIONID should be seperated. Please help me out.. Any help would be appreciated .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2018, 2:37pm UTC](https://discuss.elastic.co/t/jsessionid-should-be-seperated/133701/2 "2018-06-26T14:37:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.