# Logstash GROK filter for tomcat logs

**URL:** <https://discuss.elastic.co/t/logstash-grok-filter-for-tomcat-logs/124213>\
**Category:** Logstash\
**Created:** [March 16, 2018, 6:21am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-tomcat-logs/124213 "2018-03-16T06:21:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashok9177](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@ashok9177](https://discuss.elastic.co/u/ashok9177)\
**Post date:** [March 16, 2018, 6:21am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-tomcat-logs/124213/1 "2018-03-16T06:21:10Z")

</div>

Hello elk team ,

i am new to elk , i need pattern that can find " _transactionid_ following value from tomcat logs and create separate field

sample logs are like below ...

2018-03-14 10:58:36,853 INFO so:165 - Female Value : 0.084370888769626617 for transactionId ABCsdf62969  
2018-03-14 10:58:36,853 INFO so:165 - White Value : 0.90355902910232544 for transactionId ABtgF62969  
2018-03-14 10:58:36,853 INFO so:165 - Black Value : 0.001742142834700644 for transactionId ZBCBfg2969  
2018-03-14 10:58:36,853 INFO so:165 - Asian Value : 0.0055485325865447521 for transactionId TBCBF62969  
2018-03-14 10:58:36,853 INFO so:165 - Hispanic Value : 0.079676181077957153 for transactionId L45BF62969  
2018-03-14 10:58:36,853 INFO so:165 - Other Value : 0.0094741648063063622 for transactionId A56BF62969  
2018-03-14 10:58:36,853 INFO so:165 - Flattened size : 1764 bytes for transactionId AB67F62969  
2018-03-14 10:58:36,853 INFO so:165 - FaceTemplateCreation for Transaction Id : ABCBF62969, Processed in : 303

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 17, 2018, 5:50am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-tomcat-logs/124213/2 "2018-03-17T05:50:53Z")

</div>

What have you tried? What did it do? How did it vary from your expectations?

The [grok constructor](http://grokconstructor.appspot.com/do/construction) may be a good place to start 🙂

---

<div class="post-metadata">

**Author:** ![ashok9177](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@ashok9177](https://discuss.elastic.co/u/ashok9177)\
**Post date:** [March 19, 2018, 5:38am UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-tomcat-logs/124213/3 "2018-03-19T05:38:49Z")

</div>

Thank for quick reply i tried below regex but didn't work  
filter {  
grok {  
match =\> { "message" =\> {%{TIMESTAMP\_ISO8601:time} %{LOGLEVEL:log\_level} %{GREEDYDATA:some\_data} transactionId %{WORD:transaction\_id}} }

}

but it didn't work , grok filter parsing failed .message grtting in elk logs

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 19, 2018, 9:39pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-tomcat-logs/124213/4 "2018-03-19T21:39:53Z")

</div>

When I pasted your pattern and the example lines in the [Grok Constructor](http://grokconstructor.appspot.com/do/match), you can see that many of the messages match 🎉

However, it looks like your format for logging the transaction id is inconsistent; you'll need to adjust your pattern to capture either:

```auto
transactionId TBCBF62969
Transaction Id : ABCBF62969

```

I'd advise using the above-linked constructor to keep honing your pattern until it matches all of the example input.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2018, 9:40pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-tomcat-logs/124213/5 "2018-04-16T21:40:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.