# Logstash/grok patterns with ECS **URL:** \ **Category:** Logstash\ **Tags:** ecs-elastic-common-schema\ **Created:** [September 3, 2019, 1:35pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871 "2019-09-03T13:35:48Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [September 3, 2019, 1:35pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/1 "2019-09-03T13:35:49Z")
For a couple weeks I've been attempting to migrate my logs to ECS. I have a running ELK 6.x cluster and it works fine, but my new cluster I want to see if I can get ECS running. I am starting from scratch so old logs don't matter. Log files are being fed from Apache with a custom log format. I can't seem to get the grok pattern to work no matter what I do. Can someone point me in the right direction? I've done lots of Googling and searching through the forums and documentation but I can't find any documentation on using logstash/grok with ECS. ---
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [September 4, 2019, 4:03pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/2 "2019-09-04T16:03:56Z")
bump ---
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [September 9, 2019, 2:00pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/3 "2019-09-09T14:00:35Z")
Is there anyone who can help or is ECS dead already? ---
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [September 12, 2019, 12:32pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/4 "2019-09-12T12:32:15Z")
Still hoping to get this figured out. ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 25, 2019, 1:08pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/5 "2019-09-25T13:08:24Z")
#metoo 🙂 checking [this url](https://www.elastic.co/guide/en/ecs/current/ecs-converting.html) Attempting to map as much as possible to ECS 1.1, only not sure if the core field: ecs.version is just a dotted name or true nested and what field set/nested field prefix to hide ones custom fields in? ---
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [September 25, 2019, 2:46pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/6 "2019-09-25T14:46:11Z")
I wish I could help! It seems we are being ignored which makes me think this was either a very bad time to launch ECS or they've given up on it already. ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 26, 2019, 7:01am UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/7 "2019-09-26T07:01:24Z")
Don't think so, also this is a Community Forum so we can't expect ElasticMembers to answer all questions we post here. Also remember they're trying to make a living of possible consulting in similar areas 😉 Anyway in general ECS makes a lot of sense for sharing various objects like dashboards etc. across use cases and work flows. So considering ECS a good initiative and will expect Elastic provided solutions to adapt to ECS. ---
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [October 15, 2019, 7:00pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/8 "2019-10-15T19:00:11Z")
Bueller? ---
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [October 21, 2019, 2:03pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/9 "2019-10-21T14:03:32Z")
Has there been any updates on documentation? ---
**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Post date:** [November 6, 2019, 6:14pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/10 "2019-11-06T18:14:41Z")
179 views, can anyone point me in any direction to get this going? ---
**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\ **Post date:** [November 29, 2019, 3:31pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/11 "2019-11-29T15:31:39Z")
Hello! Sorry this was overlooked. We need to promote the [elastic-common-schema](https://discuss.elastic.co/tags/elastic-common-schema) tag more, it seems. Make sure you apply the tag, any time you have an ECS related question 🙂 What problems are you encountering with your grok patterns? The obvious one I could guess is about field nesting. All fields in ECS should be nested, no dots in key names. Dots are used as a shorthand to represent the nesting. So in your grok you can get nested fields using square brackets, like `%{IPORHOST:[url][domain]}`. [Here's a more fleshed out example](https://discuss.elastic.co/t/parsing-url-with-logstash-using-ecs-fields-nested/209953) > Is ECS dead already? Not at all 😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 27, 2019, 3:44pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/12 "2019-12-27T15:44:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. ---
**Author:** ![roaksoax](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roaksoax/32/45433_2.png) [@roaksoax](https://discuss.elastic.co/u/roaksoax)\ **Post date:** [November 10, 2020, 6:33pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871/13 "2020-11-10T18:33:10Z")
FWIW, Logstash team is working on adding ECS support to the grok patterns. You can track the progress in [https://github.com/logstash-plugins/logstash-patterns-core/issues/278](https://github.com/logstash-plugins/logstash-patterns-core/issues/278)