# Logstash Grok filter query in Logstash.conf

**URL:** <https://discuss.elastic.co/t/logstash-grok-filter-query-in-logstash-conf/176195>\
**Category:** Logstash\
**Created:** [April 10, 2019, 10:09am UTC](https://discuss.elastic.co/t/logstash-grok-filter-query-in-logstash-conf/176195 "2019-04-10T10:09:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raju\_Bhagat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raju_bhagat/32/43206_2.png) [@Raju\_Bhagat](https://discuss.elastic.co/u/Raju_Bhagat)\
**Post date:** [April 10, 2019, 10:09am UTC](https://discuss.elastic.co/t/logstash-grok-filter-query-in-logstash-conf/176195/1 "2019-04-10T10:09:17Z")

</div>

Dear Community Members,

I am new to grok. Following are the log message to which I want to extract fields values like :  
Method : createCabinet  
Argument : {"comments":....}  
Result : \<201 Created,Folder ....  
Time : 21611 msec  
CorrelationId : 00905cda-10a0-4793-8b77-e1dba05dcb2c

Log Message :

16:43:45.159 [http-nio-8183-exec-9] INFO com.newgen.aspect.LoggingAspect - Method : createCabinet | Argument : {"comments":"Default cabinet precreated by system","ownerName":"manoj","usedFor":"general","folderName":"Cabinet80704183","ownerId":"AVlFxAVOoeDBAMtAMzee","folderType":"cabinet"}{"bytes":[49,50,51,52,53],"empty":false} | Result : \<201 Created,Folder [id=5cac7e618dd9854e78007736, folderName=Cabinet80704183, folderType=cabinet, comments=Default cabinet precreated by system, parentFolderId=null, ownerName=manoj, ownerId=AVlFxAVOoeDBAMtAMzee, creationDateTime=Tue Apr 09 16:43:34 IST 2019, revisedDateTime=null, accessDateTime=null, usedFor=general, version=0, metadataId=null, tenantId=12345],{}\> | Time : 21611 msec | CorrelationId : 00905cda-10a0-4793-8b77-e1dba05dcb2c

I am debugging this on [https://grokdebug.herokuapp.com](https://grokdebug.herokuapp.com)  
So far unable to construct the required grok filter for logstash. Appreciate your help on this.

Thanks,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 10, 2019, 12:22pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-query-in-logstash-conf/176195/2 "2019-04-10T12:22:47Z")

</div>

Try dissect instead of grok

```
dissect { mapping => { "message" => "%{}Method : %{method} | Argument : %{argument} | Result : %{result} | Time : %{time} msec | CorrelationId : %{correlationId}" } }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2019, 12:22pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-query-in-logstash-conf/176195/3 "2019-05-08T12:22:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.