# Log parsing in logstash

**URL:** <https://discuss.elastic.co/t/log-parsing-in-logstash/201313>\
**Category:** Logs\
**Created:** [September 26, 2019, 9:17pm UTC](https://discuss.elastic.co/t/log-parsing-in-logstash/201313 "2019-09-26T21:17:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sk545](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@sk545](https://discuss.elastic.co/u/sk545)\
**Post date:** [September 26, 2019, 9:17pm UTC](https://discuss.elastic.co/t/log-parsing-in-logstash/201313/1 "2019-09-26T21:17:25Z")

</div>

I am wondering , how can i parse below sample event into relevant fields in logstash ?currently i am not seeing any fields from this log in Kibana UI

{"COMPILATION\_TIME":40,"DATABASE\_ID":19,"DATABASE\_NAME":"EEERD","END\_TIME":"2019-09-25 07:19:22.397 -0400","EXECUTION\_STATUS":"SUCCESS","EXECUTION\_TIME":13,"INBOUND\_DATA\_TRANSFER\_BYTES":0,"OUTBOUND\_DATA\_TRANSFER\_BYTES":0,"QUERY\_ID":"018f1f27-030c-c5e0-0000-18a11974c28e","QUERY\_TAG":"","QUERY\_TEXT":"GRANT REFERENCES ON EEERD.WS\_EDT\_DATA\_DEV.EDTCNTLPORTCYCBLZTMP3 to role EEER\_DB\_CATALOG;","QUERY\_TYPE":"GRANT","QUEUED\_OVERLOAD\_TIME":0,"QUEUED\_PROVISIONING\_TIME":0,"QUEUED\_REPAIR\_TIME":0,"ROLE\_NAME":"EEER\_DB\_DEPLOY","SCHEMA\_NAME":"INFORMATION\_SCHEMA","SESSION\_ID":27079812049690,"START\_TIME":"2019-09-25 07:19:22.314 -0400","TOTAL\_ELAPSED\_TIME":83,"TRANSACTION\_BLOCKED\_TIME":0,"USER\_NAME":"ABCZXGT","WAREHOUSE\_ID":49,"WAREHOUSE\_NAME":"RE\_TY\_USER\_RRR\_WH"}

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [September 27, 2019, 11:07am UTC](https://discuss.elastic.co/t/log-parsing-in-logstash/201313/2 "2019-09-27T11:07:02Z")

</div>

Hi @sk545,

could you give us a bit more context about your setup?

- Which version of the Elastic Stack are you using?
- Do you wish to view these events in discover or in the Logs UI?
- What should the log message look like that you want to be displayed?

---

<div class="post-metadata">

**Author:** ![sk545](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@sk545](https://discuss.elastic.co/u/sk545)\
**Post date:** [September 27, 2019, 1:35pm UTC](https://discuss.elastic.co/t/log-parsing-in-logstash/201313/3 "2019-09-27T13:35:08Z")

</div>

1. logstash -- 7.3.2  
Elastic search: 7.1  
Kibana:7.1.1

2. i wish to view these events in discover

3. my end goal is to parse the sample log i have shown above into relevant separate fields by using "GROK" pattern or in some other way.for example like below

COMPILATION\_TIME:40  
DATABASE\_ID: 34  
......  
.........  
.......  
etc.,

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [September 27, 2019, 10:31pm UTC](https://discuss.elastic.co/t/log-parsing-in-logstash/201313/4 "2019-09-27T22:31:44Z")

</div>

The example event you provided seems to be JSON-encoded. That means that you could tell logstash to decode it when reading by setting the [json](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-json.html) [codec](https://www.elastic.co/guide/en/logstash/current/data-deserialization.html) option on your input configuration. That should make the individual fields available on the event document.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2019, 10:31pm UTC](https://discuss.elastic.co/t/log-parsing-in-logstash/201313/5 "2019-10-25T22:31:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.