# Loading unstructured data

**URL:** <https://discuss.elastic.co/t/loading-unstructured-data/304212>\
**Category:** Logstash\
**Created:** [May 9, 2022, 6:24am UTC](https://discuss.elastic.co/t/loading-unstructured-data/304212 "2022-05-09T06:24:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Naga\_Prudhvi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/naga_prudhvi/32/99501_2.png) [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\
**Post date:** [May 9, 2022, 6:24am UTC](https://discuss.elastic.co/t/loading-unstructured-data/304212/1 "2022-05-09T06:24:03Z")

</div>

I am getting error while loading below line in elastic using gork filter

[192.168.72.177](http://192.168.72.177) - - [22/Dec/2002:23:32:14 -0400] "GET  
/news/sports.html HTTP/1.1" 200 3500 [www.yahoo.com](http://www.yahoo.com)  
"[http://www.some.com/](http://www.some.com/)" "Mozilla/4.0 (compatible; MSIE .

Can someone help me with gork pattern

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 9, 2022, 8:20am UTC](https://discuss.elastic.co/t/loading-unstructured-data/304212/2 "2022-05-09T08:20:15Z")

</div>

This is Apache log.  
192.168.72.177 - - [22/Dec/2002:23:32:14 -0400] "GET /news/sports.html HTTP/1.1" 200 3500 [www.yahoo.com](http://www.yahoo.com) "[http://www.some.com/](http://www.some.com/)" "Mozilla/4.0 (compatible; MSIE ."

Use:

```auto
grok { 
	match => { 
		"message" => "%{COMMONAPACHELOG}"
	} 
}

```

COMMONAPACHELOG or COMBINEDAPACHELOG  
[logstash-patterns/grok-patterns at master · hpcugent/logstash-patterns · GitHub](http://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns)

---

<div class="post-metadata">

**Author:** ![adrianfusco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianfusco/32/111798_2.png) [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\
**Post date:** [May 9, 2022, 8:25am UTC](https://discuss.elastic.co/t/loading-unstructured-data/304212/3 "2022-05-09T08:25:33Z")

</div>

Hello,

- What error do you have?
- What's the grok pattern you're trying?

It can be helpful to know what are you trying and give a better answer.

You can use `%{COMMONAPACHELOG}` mentioned by @Rios

Or you can also try with the following grok pattern (I think it's not necessary to explain every field, in this case the words make sense):

```auto
%{IP:client_ip} - - \[%{HTTPDATE:apache_timestamp}\] \"%{WORD:method} /%{NOTSPACE:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response} %{NUMBER:data_transfered} %{HOSTNAME:website} \"%{URI}\" \"%{GREEDYDATA:useragent}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/1/814f2f72cd660165cf5f51690848db87737e1b00.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2022, 8:26am UTC](https://discuss.elastic.co/t/loading-unstructured-data/304212/4 "2022-06-06T08:26:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.