# Logstash and flexlm log

**URL:** https://discuss.elastic.co/t/logstash-and-flexlm-log/29766
**Category:** Logstash
**Created:** [September 22, 2015, 9:26am UTC](https://discuss.elastic.co/t/logstash-and-flexlm-log/29766 "2015-09-22T09:26:15Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![el\_tunisiano38](https://avatars.discourse-cdn.com/v4/letter/e/e0b2c6/32.png) [@el\_tunisiano38](https://discuss.elastic.co/u/el_tunisiano38)
#### Post date: [September 22, 2015, 9:26am UTC](https://discuss.elastic.co/t/logstash-and-flexlm-log/29766/1 "2015-09-22T09:26:15Z")

</div>

Hi everyone,

I am newbie at logstash and would like to parse a flexlm log file. The problem is the log is not easy to parse.

(lmgrd) FlexNet Licensing blabla TIMESTAMP 06/12/2015  
09:25:48 (MLM) OUT: "MATLAB" USER2@MACH529  
10:28:56 (MLM) IN: "MATLAB" USER2@MACH529

what's the best way to concatenate the Date (DD/MM/YYYY) with the time ?

i already used memorized filter, but it didn't let me concatenate these 2 fields.  
"checkout\_time" =\> "%{flexlm\_ts} 09:25:48"

Thanks in advance for your help, and sorry for my bad english.

---

<div class="post-metadata">

### Author: ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)
#### Post date: [September 23, 2015, 3:18pm UTC](https://discuss.elastic.co/t/logstash-and-flexlm-log/29766/2 "2015-09-23T15:18:57Z")

</div>

> [@el\_tunisiano38](#):
>
> memorized

Hi @el_tunisiano38, can you post your current logstash filter configuration ?

Thanks

---

<div class="post-metadata">

### Author: ![el\_tunisiano38](https://avatars.discourse-cdn.com/v4/letter/e/e0b2c6/32.png) [@el\_tunisiano38](https://discuss.elastic.co/u/el_tunisiano38)
#### Post date: [September 24, 2015, 10:24am UTC](https://discuss.elastic.co/t/logstash-and-flexlm-log/29766/3 "2015-09-24T10:24:39Z")

</div>

yes of course,

filter {

```
  if [type] == "flexlm" {

   if [message] =~ /TIMESTAMP/ {
        grok {
                match => ["message", "%{GREEDYDATA:greedy_data} TIMESTAMP %{DATE:flexlm_ts}"]
             }
    }

    else if [message] =~ /OUT/ {
        grok {
            match => ["message", "%{DATA:checkout_time} \(%{DATA:vendor}\) OUT: \"%{DATA:feature_name}\" %{DATA:user_id}@%{DATA:client_machine}"]
        }
            mutate { replace => ["checkout_time", "%{flexlm_ts} %{checkout_time}"] }
    }
         memorize {
             fields => ['flexlm_ts']
        }
   }
}
```

---

<div class="post-metadata">

### Author: ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)
#### Post date: [September 24, 2015, 1:38pm UTC](https://discuss.elastic.co/t/logstash-and-flexlm-log/29766/4 "2015-09-24T13:38:26Z")

</div>

Hi @el_tunisiano38,

I found the problem, but I must first point out that logstash-filter-memorize is not an officially supported plugin (although I agree it does seem rather useful!)

When the filter runs, it has 2 jobs - it memorizes fields, and also injects memorized fields into the event. Since filters run in sequence, the memorized field had not yet been injected into the event when you tried to access it. Try this instead:

```auto
filter {

   if [message] =~ /TIMESTAMP/ {
        grok {
                match => ["message", "%{GREEDYDATA:greedy_data} TIMESTAMP %{DATE:flexlm_ts}"]
        }
    }

    memorize {
        fields => ["flexlm_ts"]
    }

    if [message] =~ /OUT/ {
        grok {
         match => ["message", "%{DATA:checkout_time} \(%{DATA:vendor}\) OUT: \"%{DATA:feature_name}\" %{DATA:user_id}@%{DATA:client_machine}"]
        }
        mutate { replace => ["checkout_time", "%{flexlm_ts} %{checkout_time}"] }
    }

}

```

---

<div class="post-metadata">

### Author: ![el\_tunisiano38](https://avatars.discourse-cdn.com/v4/letter/e/e0b2c6/32.png) [@el\_tunisiano38](https://discuss.elastic.co/u/el_tunisiano38)
#### Post date: [September 24, 2015, 2:05pm UTC](https://discuss.elastic.co/t/logstash-and-flexlm-log/29766/5 "2015-09-24T14:05:05Z")

</div>

Hi Phaedrus,

Thanks alot, it works this way. but i tried a third option which does'nt work also except yours). I Placed the memorize in the first if block.

Thanks again.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:28am UTC](https://discuss.elastic.co/t/logstash-and-flexlm-log/29766/6 "2017-07-06T05:28:08Z")

</div>