Thanks for sharing that info. Yes I did try and seems the pattern is not working out correct. Reason I think so is that logstash waits after launch not scrolling any data on console which it does if it was able to match the pattern. I tried using the log4j pattern on the log4j config and then using the constructor site tried generating the grok pattern. I was able to load a test file with corresponding know pattern hence I feel the setup is ok,