# Logstash config with Grok **URL:** \ **Category:** Logstash\ **Created:** [May 11, 2024, 6:59am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299 "2024-05-11T06:59:37Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 11, 2024, 6:59am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/1 "2024-05-11T06:59:37Z")
Hi Everyone, I am trying to config logstash parse the log with 3 field : date & time (dts), Log level (lvl) and rest message. But the out put always show timestamp is not correct, timestamp i want to show is the time in the log error but it show the time of local machine. Please give me advice. Below are logstash conf anf the output FYI -\> The error sample is: 2022-03-15 12:42:28.5801 INFO 1 Com.Bmc.Ctmem.EmCSInfrustructure.EMFoundations.GetEMLogLocation C:\Program Files\BMC Software\Control-M EM\CBMTCTCAPR01\_0\log\ -\> logstash conf: input { beats { port =\> 5044 } } filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:dts}%{SPACE}%{LOGLEVEL:lvl}%{GREEDYDATA:rest}" }} date { match =\> ["dts" , "yyyy-MM-dd HH:mm:ss,SSSS"] } } output { stdout { codec =\> rubydebug } } -\> tghe output as screenshot ![Screenshot 2024-05-11 135833](https://us1.discourse-cdn.com/elastic/original/3X/7/3/73fcbbc6cf6fd1d36819518c276363ca33c65b32.png) Thanks all ---
**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\ **Post date:** [May 11, 2024, 1:29pm UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/2 "2024-05-11T13:29:43Z")
Hi @iceman0410, Below is the grok pattern which worked from me - ![Screenshot 2024-05-11 at 6.57.36 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc96811038296bdd75b94fc5f5a8eae617d040cc.png) Logtstash default adds `@timestamp` field with local timestamp. You can overwrite it using [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) like below. ```auto input { # Your input configuration here } filter { grok { match => { "message" => "%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:level} %{NUMBER:info_number} %{GREEDYDATA:class} %{GREEDYDATA:file_path}" } } date { match => ["log_timestamp", "yyyy-MM-dd HH:mm:ss.SSSSSSSSS"] target => "@timestamp" } } output { # Your output configuration here } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 11, 2024, 1:42pm UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/3 "2024-05-11T13:42:27Z")
> [@iceman0410](#): > > date { match =\> ["dts" , "yyyy-MM-dd HH:mm:ss,SSSS"] } Your logtimestamp field has ss.SSSS, not ss,SSSS Please do not post pictures of text, some folks cannot see them, they are not searchable, and we cannot copy/paste them to try to reproduce the issue. ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 12, 2024, 2:00am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/4 "2024-05-12T02:00:22Z")
Thanks @ashishtiwari1993 , it is working now ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 12, 2024, 2:10am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/5 "2024-05-12T02:10:57Z")
Thanks @Badger , i added one more grok filter for another parser filter. Could you help me check logstash conf below? Logstash conf : input { beats { port =\> 5044 } } filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:dts}%{SPACE}%{LOGLEVEL:lvl}%{GREEDYDATA:rest}" }} date { match =\> ["dts" , "yyyy-MM-dd HH:mm:ss.SSSS"] target =\> "@timestamp" } grok { match =\> { "message" =\> "(?%{DATE\_EU}%{SPACE}%{TIME})%{GREEDYDATA:rest}"}} date { match =\> ["dts" , "dd/MM/yyyy HH:mm:ss.SSS"] tagret =\> "@timestamp" } } output { stdout { codec =\> rubydebug } } The error sample: 30/03/2022 07:50:44.590 [0] emthriftserviceclientfactory EMTHttpClientPoolInitializer::clearPool clearPool called. Thanks everyone ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 12, 2024, 2:16pm UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/6 "2024-05-12T14:16:16Z")
You could try ``` grok { match => { "message" => [ "%{TIMESTAMP_ISO8601:dts} %{WORD:level} %{NUMBER:info_number} %{JAVACLASS:class} %{GREEDYDATA:file_path}", "(?%{DATE_EU}%{SPACE}%{TIME})%{GREEDYDATA:rest}" ] } } date { match => ["dts", "yyyy-MM-dd HH:mm:ss.SSSSSSSSS", "dd/MM/YYYY HH:mm:ss.SSS"] } ``` ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 13, 2024, 3:23am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/7 "2024-05-13T03:23:54Z")
Thanks @Badger , it is working ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 13, 2024, 6:55am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/8 "2024-05-13T06:55:37Z")
Hi @Badger , i have another log as below 0711 06:40:23.726:pid=119813:ERR:../../proto/ssl/openssl\_tls.c:359:SSLsess=2472cd0:SSL\_connect:SSL\_ERROR\_SYSCALL: write error system error 104 My grok: %{MONTHNUM:month}%{MONTHDAY:day}%{SPACE}%{TIME:time}%{NOTSPACE}%{LOGLEVEL:LVL}%{GREEDYDATA:REST} output can not get pid. Could you please give advice. Thanks [ { "month": 7, "day": 11, "time": "06:40:23.726", "LVL": "ERROR", "REST": "\_SYSCALL: write error system error 104" } ] ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 13, 2024, 10:40am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/9 "2024-05-13T10:40:47Z")
> [@iceman0410](#): > > %{NOTSPACE}% This is throwing away the pid. Try retaining that field by naming it, then refine the pattern to extract the pid. ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 14, 2024, 3:21am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/10 "2024-05-14T03:21:29Z")
Thanks @Badger . it is working with grok below: ?%{MONTHNUM:month}%{MONTHDAY:day}%{SPACE}%{TIME:time})%{DATA:PID}%{SPACE}%{LOGLEVEL:LVL}%{GREEDYDATA:REST} Could you advice for another sample below. it's contained AM/PM format: "Jul 11, 2022 6:44:49 AM org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi getDefaultTrustStore INFO: Initializing with trust store at path: /app/ctrlm-agent/ctm/cm/AFT/JRE\_11/lib/security/cacerts" Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 14, 2024, 11:14am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/11 "2024-05-14T11:14:03Z")
Define a custom pattern for the grok and then parse it in the date filter using `MMM dd, yyyy hh:mm:ss a`. (Note hh rather than HH since this is hour of the half-day.) ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 15, 2024, 2:10am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/12 "2024-05-15T02:10:59Z")
> [@Badger](#): > > MMM dd, yyyy hh:mm:ss a Hi @Badger , I tried: (?%{MONTH:month} %{MONTHDAY:day}, %{YEAR:year} %{TIME} (AM|PM)) %{GREEDYDATA:rest} . Can get the correct date output. Can you advice how i can split Loglevel INFO and "org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi getDefaultTrustStore" -\> i don't know how can define this one Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 15, 2024, 2:40am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/13 "2024-05-15T02:40:23Z")
It will be like one of your earlier examples, JAVACLASS will match the class name and LOGLEVEL will match the log level. ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 15, 2024, 11:12am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/14 "2024-05-15T11:12:38Z")
Hi @Badger , Can you check my grok as below, i tried to add JAVACLASS but it does not work ![ddddddd](https://us1.discourse-cdn.com/elastic/original/3X/d/f/df08488aa131a8d749a4a43b755e5ada1833de43.png) Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 15, 2024, 1:15pm UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/15 "2024-05-15T13:15:00Z")
That grok does not use JAVACLASS, also, the alternation for AM|PM is wrong, it needs to be surrounded by parentheses. ---
**Author:** ![iceman0410](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iceman0410/32/134395_2.png) [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Post date:** [May 21, 2024, 5:31am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299/18 "2024-05-21T05:31:48Z")
Thanks @Badger . I have another log message with multi lines need to parse. Can you have a look. My Grok can not get the rest of lines ![12](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c2c797037a8a9b479055285fc05e08dc87394edc.png) My Grok: %{LOGLEVEL:lvl}%{SPACE}%{TIMESTAMP\_ISO8601:dts}%{SPACE}%{SPACE}%{GREEDYDATA:rest} Thanks