# Logstash-grok-filtering problem
**URL:** https://discuss.elastic.co/t/logstash-grok-filtering-problem/104888
**Category:** Logstash
**Created:** [October 23, 2017, 11:18am UTC](https://discuss.elastic.co/t/logstash-grok-filtering-problem/104888 "2017-10-23T11:18:34Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [October 23, 2017, 11:18am UTC](https://discuss.elastic.co/t/logstash-grok-filtering-problem/104888/1 "2017-10-23T11:18:34Z")
my Example logs:
2017-10-23 16:59:21,784 : [INFO] http-nio-8080-exec-1597 [c.n.s.c.AbstractSmsClient:567] SENT =\> smsStatus : [TELCO\_SENT] | clientSmsId/gatewaySmsId : [13383383/GP:DAC:GET] | cell : [1712277206] | nazdaqSmsId : [10010337] | smsStatusMsg : [null]
filter {
grok {
match =\> ["message", "%{SYSLOGTIMESTAMP:delivery\_time}", "%{DATA:Loglevel}", "%{DATA:thread}", "[%{DATA:Client\_pid}", "%{DATA:Status}", "%{DATA:Operator}", "%{DATA:cell}", "%{DATA:nazdaqSmsId}", "%{GREEDYDATA:log}"]
}
}
JSON file:
{
"\_index": "filebeat-2017.10.23",
"\_type": "logs",
"_id": "AV9I4xsLflvzLo5n6OG_",
"\_version": 1,
"\_score": null,
"\_source": {
"@timestamp": "2017-10-23T10:59:23.008Z",
"host": "vNTDACLSWEBP001",
"source": "/home/local/user/nsms/logs/Logs/nsms-server.log",
"message": "2017-10-23 16:59:21,784 : [INFO] http-nio-8080-exec-1597 [c.n.s.c.AbstractSmsClient:567] SENT =\> smsStatus : [TELCO\_SENT] | clientSmsId/gatewaySmsId : [13383383/GP:DAC:GET] | cell : [1712277206] | nazdaqSmsId : [10010337] | smsStatusMsg : [null]"
But I need the following field
Status: TELCO\_SENT
Operator: GP:DAC:GET
Cell : 1712277206
Loglevel: INFO
delivery\_time: 2017-10-23 16:59:21,784
What is my wrong?
help me anybody please.
Thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 23, 2017, 1:37pm UTC](https://discuss.elastic.co/t/logstash-grok-filtering-problem/104888/2 "2017-10-23T13:37:29Z")
Multiple problems:
- I don't think SYSLOGTIMESTAMP is the right pattern to for your timestamp.
- Use a single grok expression instead of your list of expressions, e.g. like this: `^%{SYSLOGTIMESTAMP:delivery_time} : \[%{DATA:Loglevel}\s*\] %{DATA:thread} \[%{DATA:Client_pid}\] ...`
- Don't use so many DATA patterns. In your case I think you'll find NOTSPACE to be a useful replacement.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2017, 1:37pm UTC](https://discuss.elastic.co/t/logstash-grok-filtering-problem/104888/3 "2017-11-20T13:37:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.