# Logstash Configuration with custom patterns

**URL:** <https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352>\
**Category:** Logstash\
**Created:** [July 24, 2018, 10:03am UTC](https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352 "2018-07-24T10:03:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [July 24, 2018, 10:03am UTC](https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352/1 "2018-07-24T10:03:41Z")

</div>

I want to read application specific logs especially for exception. So i created a "patterns" folder in config folder and added the patterns and the file looks like :

> ```
> #Extra patterns for grok
> EISLOGFORMAT %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level}\s*%{JAVACLASS:class}\.%{WORD:method} %{NUMBER:timeTakenForExecution:"\d+"}\s*-\s*%{GREEDYDATA:log}
> EISEXCEPTIONFORMAT %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level}\s*%{JAVACLASS:class}.*: %{JAVACLASS:exception}.*
> 
> ```

and in my conf file i have added "patterns\_dir=\>"./patterns" " under filter,grok snippet.

But when i start my logstash i see error :

```
> [2018-07-24T15:11:35,028][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<Grok::PatternError: pattern %{EISLOGFORMAT:eisText} not defined>, :backtrace=>["C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/jls-grok-0.11.4/lib/grok-pure.rb:123:in `block in compile'", "org/jruby/RubyKernel.java:1292:in `loop'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/jls-grok-0.11.4/lib/grok-pure.rb:93:in `compile'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:281:in `block in register'", "org/jruby/RubyArray.java:1734:in `each'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:275:in `block in register'", "org/jruby/RubyHash.java:1343:in `each'", "C:/tools/logstash-6.3.0/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:270:in `register'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:340:in `register_plugin'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:351:in `block in register_plugins'", "org/jruby/RubyArray.java:1734:in `each'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:351:in `register_plugins'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:729:in `maybe_setup_out_plugins'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:361:in `start_workers'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:288:in `run'", "C:/tools/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:248:in `block in start'"], :thread=>"#<Thread:0x77630be7 run>"}
> [2018-07-24T15:11:35,064][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

```

kindly suggest

---

<div class="post-metadata">

**Author:** ![Charaf\_Ahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charaf_ahmed/32/30467_2.png) [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)\
**Post date:** [July 24, 2018, 10:08am UTC](https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352/2 "2018-07-24T10:08:39Z")

</div>

> [@Raghuveer\_SJ](#):
>
> and in my conf file i have added "patterns\_dir=\>"./patterns" " under filter,grok snippet

you can just try : patterns\_dir=\>"patterns"

---

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [July 24, 2018, 10:25am UTC](https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352/3 "2018-07-24T10:25:13Z")

</div>

Sorry for the confusion but i tried that nogo ...

I have given the name of the file as morepatterns though should i be using it anywhere ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2018, 10:25am UTC](https://discuss.elastic.co/t/logstash-configuration-with-custom-patterns/141352/4 "2018-08-21T10:25:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.