# Logstash grok filter is having issue

**URL:** https://discuss.elastic.co/t/logstash-grok-filter-is-having-issue/163212
**Category:** Logstash
**Created:** [January 7, 2019, 1:01pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-is-having-issue/163212 "2019-01-07T13:01:18Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [January 7, 2019, 3:27pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-is-having-issue/163212/2 "2019-01-07T15:27:23Z")

</div>

Hi @nitin.jangid,

it would be much easier to read the config if it would be formatted correctly...

Anyhow, if you have Kibana available then I would suggest using `Kibana > Dev Tools > Grok Debugger` to work on your Grok pattern.

You can also test your Logstash config from STDIN to STDOUT. Here is an [example](https://discuss.elastic.co/t/import-21gb-csv-to-elasticsearch/162771/2).

Looks like you will need some custom Grok patterns...

Here's an example start

> %{IP:clientip}%{SPACE}-%{SPACE}-%{SPACE}[%{HTTPDATE:date}]%{SPACE}"%{WORD:action}%{SPACE}/%{WORD:words}/%{WORD:words}/%{EMAILADDRESS:login}

My Grok-foo is not that great so this can probably be improved on...

---

_[View the full topic](https://discuss.elastic.co/t/logstash-grok-filter-is-having-issue/163212)._