# Logstash not filter but pattern works

**URL:** <https://discuss.elastic.co/t/logstash-not-filter-but-pattern-works/100503>\
**Category:** Logstash\
**Created:** [September 14, 2017, 9:48am UTC](https://discuss.elastic.co/t/logstash-not-filter-but-pattern-works/100503 "2017-09-14T09:48:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akosih](https://avatars.discourse-cdn.com/v4/letter/a/b487fb/32.png) [@Akosih](https://discuss.elastic.co/u/Akosih)\
**Post date:** [September 14, 2017, 9:48am UTC](https://discuss.elastic.co/t/logstash-not-filter-but-pattern-works/100503/1 "2017-09-14T09:48:48Z")

</div>

Hi,

My first topic i hope i will not make a duplicate ☹

I got a problem

I custom my logstash filter to ingest catalina.out logs, the pattern included doesn't fit me so i build this:

Exemple of log:

> 2017-09-13 12:01:20 [f05e3812] info [native] Command line is /usr/java/default/bin/java -Djava.util.logging.config.file=/opt/tomcat-servers/TOMCAT/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Xmx256m -Xms256m -server -Dorg.apache.catalina.security.SecurityListener.UMASK=0007 -Djava.awt.headless=true -Dsun.net.inetaddr.ttl=600 -XX:+UseG1GC -XX:+UseStringDeduplication -DLOG\_ROOT\_PATH=/opt/applogs/TOMCAT -Dcom.decathlon.environment=PRE\_PRODUCTION -Djava.security.egd=file:///dev/urandom -Dinstance.tomcat=TOMCAT -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=[rtdkz1rfi01.dktetrix.net](http://rtdkz1rfi01.dktetrix.net) --Dmqjazzconfig=/opt/mqjazz/mqmapp/config/flux.properties -Dflows=true -Djava.security.egd=file:///dev/urandom -XX:MaxMetaspaceSize=128M -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/opt/applogs/RFID\_API01 -XX:OnOutOfMemoryError=/opt/tomcat-servers/bin/manageHPROF.sh\_%p -Djdk.tls.ephemeralDHKeySize=2048 -Djava.endorsed.dirs=/opt/apache-tomcat/endorsed -classpath /opt/apache-tomcat/bin/bootstrap.jar:/opt/apache-tomcat/bin/tomcat-juli.jar

my filter

> `20%{YEAR:Year}-%{MONTHNUM:Month}-%{MONTHDAY:Day} %{TIME:Time} \[%{GREEDYDATA:sequence}\] %{LOGLEVEL:Loglevel} %{GREEDYDATA:error_message}`

The pattern work successful

 ![40](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cb34cf314c6c3c28da91242fd4d143ebe77da242.png)

BUT !!!

When the logstash doesnt apply the filter

> {  
> "@timestamp" =\> 2017-09-14T09:36:43.281Z,  
> "offset" =\> 2047,  
> "@version" =\> "1",  
> "input\_type" =\> "log",  
> "beat" =\> {  
> "hostname" =\> "[rtdkz1rfi01.dktetrix.net](http://rtdkz1rfi01.dktetrix.net)",  
> "name" =\> "[rtdkz1rfi01.dktetrix.net](http://rtdkz1rfi01.dktetrix.net)",  
> "version" =\> "5.5.2"  
> },  
> "host" =\> "[rtdkz1rfi01.dktetrix.net](http://rtdkz1rfi01.dktetrix.net)",  
> "source" =\> "/opt/tomcat-servers/RFID\_API01/logs/catalina.out",  
> "message" =\> "2017-09-13 12:08:35 [554fc844] info [native] Hot Sensor Placement ........ available",  
> "type" =\> "tomcat\_catalina\_out",  
> "tags" =\> [  
> [0] "beats\_input\_codec\_plain\_applied"  
> ]  
> }

Here is my beat configuration (i got multine for information)

> - input\_type: log  
> paths:
> - /opt/tomcat-servers/RFID\_API01/logs/catalina.out  
> document\_type: tomcat\_catalina\_out  
> exclude\_lines: ["^---------","DEBUG"]  
> include\_lines: ["^20"]

And my logstash filter:

> ```
> if [type] == "tomcat_catalina_out" {
> grok {
> match => { "message" => "20%{YEAR:Year}-%{MONTHNUM:Month}-%{MONTHDAY:Day} %{TIME:Time} %{GREEDYDATA:error_message}" }
> }
> 
> ```
> 
> }

Do you have any clue ??  
Thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2017, 9:48am UTC](https://discuss.elastic.co/t/logstash-not-filter-but-pattern-works/100503/2 "2017-10-12T09:48:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.