# Logstash configuration **URL:** \ **Category:** Logstash\ **Created:** [February 14, 2017, 7:46am UTC](https://discuss.elastic.co/t/logstash-configuration/74982 "2017-02-14T07:46:30Z")\ **Posts on this page:** 8\ **Page:** 3
**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Post date:** [March 4, 2017, 7:56am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/41 "2017-03-04T07:56:44Z")
I tried this filter to skip mongo logs other than "command" filter { ``` grok { match => { message => ``` "%{TIMESTAMP\_ISO8601:@timestamp} %{MONGO3\_SEVERITY:severity} %{MONGO3\_COMPONENT:component}%{SPACE}(?:[%{DATA:context}])? %{GREEDYDATA:content}" } ``` } if [component] != " COMMAND " { drop { } } ``` logstash is start successfully but it not showing any output ---
**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Post date:** [March 17, 2017, 4:44am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/42 "2017-03-17T04:44:53Z")
command hitesh.restaurants command: drop { drop: "restaurants" } keyUpdates:0 writeConflicts:0 numYields:0 reslen:81 locks:{ Global: { acquireCount: { r: 1, w: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op\_query 39ms this is my output of logstash config file. now can i seperate only query time that is 39ms??? I tried this using dissect filter.But the space between every field is given problem. it gives output like below { "severity" =\> "I", "numYields" =\> "drop:", "query" =\> "command", "pid" =\> "", "collection" =\> "writeConflicts:0", "message" =\> "2017-03-14T17:29:54.037+0530 I COMMAND [conn4] command hitesh.restaurants command: drop { drop: "restaurants" } keyUpdates:0 writeConflicts:0 numYields:0 reslen:81 locks:{ Global: { acquireCount: { r: 1, w: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op\_query 39ms\r", "locks" =\> "}", "content" =\> "numYields:0 reslen:81 locks:{ Global: { acquireCount: { r: 1, w: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op\_query 39ms\r", "command" =\> "hitesh.restaurants", "path" =\> "C:/data/log/mongo2.log", "writeConflicts" =\> "{", "component" =\> "COMMAND", "database" =\> "keyUpdates:0", "protocol" =\> "", "@timestamp" =\> 2017-03-16T10:12:23.196Z, "ninserted" =\> "command:", "keyUpdates" =\> "drop", "@version" =\> "1", "host" =\> "DESKTOP-PKMSR1Q", "context" =\> "conn4", "reslen" =\> ""restaurants"" } please help ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 17, 2017, 6:17am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/43 "2017-03-17T06:17:51Z")
What does your configuration look like? I've never used the dissect filter but maybe I can help anyway. ---
**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Post date:** [March 17, 2017, 6:35am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/44 "2017-03-17T06:35:23Z")
following is my filter dissect { "content" =\> "%{query} %{command} %{ninserted} %{keyUpdates} %{writeConflicts} %{numYields} %{reslen} %{locks} %{database} %{collection} %{protocol} [%{pid}]: %{content}"} ---
**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Post date:** [March 17, 2017, 6:37am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/45 "2017-03-17T06:37:57Z")
input { file { path =\> "C:/Data/log/mongo97.log" start\_position =\> "beginning" } } filter { grok { ``` match => { message => "%{TIMESTAMP_ISO8601:timestamp} %{MONGO3_SEVERITY:severity} %{MONGO3_COMPONENT:component}%{SPACE}(?:\[%{DATA:context}\])? %{GREEDYDATA:content}"} } mutate { remove_field => ["message" ,"@timestamp" , "tags" , "@version"] } if [component] != "COMMAND" { drop { } } dissect { ``` "content" =\> "%{query} %{command} %{ninserted} %{keyUpdates} %{writeConflicts} %{numYields} %{reslen} %{locks} %{database} %{collection} %{protocol} [%{pid}]: %{content}"} } output { elasticsearch{ hosts =\> ["localhost:9000"] index =\> "logs1" } stdout {codec =\> "rubydebug" } } this is config file ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 17, 2017, 6:43am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/46 "2017-03-17T06:43:14Z")
This is hard to follow since you appear to be overwriting the input `content` field with the `content` field captured by the dissect filter. Please use different fields and try again. ---
**Author:** ![Nikparab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikparab/32/17493_2.png) [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Post date:** [March 20, 2017, 8:04am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/47 "2017-03-20T08:04:32Z")
thanks @magnusbaeck. I got the expected result by writing grok expression as follow grok { ``` match => { message => ``` "%{TIMESTAMP\_ISO8601:@timestamp} %{MONGO3\_SEVERITY:severity} %{MONGO3\_COMPONENT:component}%{SPACE}(?:[%{DATA:context}])? %{GREEDYDATA:content}.\*%{NUMBER:duration}" } } thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 17, 2017, 8:05am UTC](https://discuss.elastic.co/t/logstash-configuration/74982/48 "2017-04-17T08:05:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/logstash-configuration/74982.md?page=2)