# Logstash existing log4j files **URL:** \ **Category:** Logstash\ **Created:** [January 19, 2017, 7:39pm UTC](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216 "2017-01-19T19:39:19Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Sacha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sacha/32/14742_2.png) [@Sacha](https://discuss.elastic.co/u/Sacha)\ **Post date:** [January 19, 2017, 7:39pm UTC](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216/1 "2017-01-19T19:39:19Z")
Tried make this work few moths back, gave up. Issue again on head. Lesson giving up does fix the problem. I have this Java applicaiton running on JBoss server and it writes Log4j files. The files go like 1 gb and rotate. Hence important I use ELK to make any sense out of it. The log4j log has following entries 14 Jan 2017 11:32:36,113 INFO STDOUT:? - [B@99541e35 14 Jan 2017 11:32:36,113 INFO STDOUT:? - 14 Jan 2017 11:32:36,113 INFO STDOUT:? - 14 Jan 2017 11:32:36,113 DEBUG AppLogger:? - 0,,com.prod.rout.core,DEBUG,ThreadPool-0-1 testDriver COM - AppInterface send success for message with unique id 42f5g34f-754d-3453-s3ffd-aa4433fffs 14 Jan 2017 11:32:36,113 DEBUG AppLogger:? - 0,,com.prod.module,DEBUG,sent response --\> 000 00000 9999999999999999 How to make Grok patter n for this. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 20, 2017, 6:43am UTC](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216/2 "2017-01-20T06:43:22Z")
Have you tried using the Grok constructor site? ---
**Author:** ![Sacha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sacha/32/14742_2.png) [@Sacha](https://discuss.elastic.co/u/Sacha)\ **Post date:** [February 6, 2017, 3:46pm UTC](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216/3 "2017-02-06T15:46:48Z")
Thanks for sharing that info. Yes I did try and seems the pattern is not working out correct. Reason I think so is that logstash waits after launch not scrolling any data on console which it does if it was able to match the pattern. I tried using the log4j pattern on the log4j config and then using the constructor site tried generating the grok pattern. I was able to load a test file with corresponding know pattern hence I feel the setup is ok, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 6, 2017, 5:41pm UTC](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216/4 "2017-02-06T17:41:42Z")
Well, if you supply details like the grok filter configuration you ended up with we might be able to help out. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 6, 2017, 5:41pm UTC](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216/5 "2017-03-06T17:41:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.