# Logstash filter with fields in the log file itself

**URL:** <https://discuss.elastic.co/t/logstash-filter-with-fields-in-the-log-file-itself/150492>\
**Category:** Logstash\
**Created:** [October 1, 2018, 12:04am UTC](https://discuss.elastic.co/t/logstash-filter-with-fields-in-the-log-file-itself/150492 "2018-10-01T00:04:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamelkuser](https://avatars.discourse-cdn.com/v4/letter/i/7993a0/32.png) [@iamelkuser](https://discuss.elastic.co/u/iamelkuser)\
**Post date:** [October 1, 2018, 12:04am UTC](https://discuss.elastic.co/t/logstash-filter-with-fields-in-the-log-file-itself/150492/1 "2018-10-01T00:04:44Z")

</div>

I have Tomcat log file as below. If you see the log file contains Token Id, Request Id. I would like to filter out (filter in .conf file) data from this log file in such a way that i can see all the logs in one shot where TokenId = 3321 (as an example) on Kibana Discover page; similarly there will be use-case where i want to see all the logs with RequestId 2345874 on Kibana Discover page. How do we do this? I tried by writing below filter, but it did not work. Please advise.

match =\> { "message" =\> ["%{COMBINEDAPACHELOG}", "TokenId: %{NUMBER:TokenId}"] }

Tomcat\_09272018.log  
60.183.171.212 - - [27/Sep/2018:00:00:15 +0000] **TokenId** : 3331 :: **RequestId** :2345874 :: Portfolio Id: 28  
180.186.112.151 - - [27/Sep/2018:00:00:20 +0000] **TokenId** : 3321 :: **RequestId** :2343474 :: Portfolio Id: 29  
168.72.204.145 - - [27/Sep/2018:00:00:25 +0000] **TokenId** : 3241 :: **RequestId** :2345879 :: Portfolio Id: 23  
84.204.225.40 - - [27/Sep/2018:00:00:30 +0000] TokenId: 3321 :: RequestId:2343474 :: Portfolio Id: 29  
184.72.89.211 - - [27/Sep/2018:00:00:35 +0000] TokenId: 3331 :: RequestId:2345874 :: Portfolio Id: 28  
152.213.20.112 - - [27/Sep/2018:00:00:40 +0000] TokenId: 3321 :: RequestId:2343474 :: Portfolio Id: 29  
100.201.134.191 - - [27/Sep/2018:00:00:45 +0000] TokenId: 3331 :: RequestId:2345874 :: Portfolio Id: 28  
196.174.214.227 - - [27/Sep/2018:00:00:50 +0000] TokenId: 3241 :: RequestId:2345879 :: Portfolio Id: 23

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 1, 2018, 5:59am UTC](https://discuss.elastic.co/t/logstash-filter-with-fields-in-the-log-file-itself/150492/2 "2018-10-01T05:59:13Z")

</div>

That is not a common Apache log format, so it is not surprising that it is not working. Have a look at [this introductory blog](https://www.elastic.co/blog/a-practical-introduction-to-logstash) which goes through how to use Logstash and build custom patterns.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2018, 5:59am UTC](https://discuss.elastic.co/t/logstash-filter-with-fields-in-the-log-file-itself/150492/3 "2018-10-29T05:59:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.