# Logstash parsing help - custom log

**URL:** <https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920>\
**Category:** Logstash\
**Created:** [April 5, 2018, 12:25pm UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920 "2018-04-05T12:25:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yuvaraja\_kannan](https://avatars.discourse-cdn.com/v4/letter/y/ba8739/32.png) [@Yuvaraja\_kannan](https://discuss.elastic.co/u/Yuvaraja_kannan)\
**Post date:** [April 5, 2018, 12:25pm UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920/1 "2018-04-05T12:25:41Z")

</div>

HI All,

The below is the sample line from my log file, May i know how do i filter out only the processName and totalExecutionTime using logstash grok. Please help.

17:44:09.0083 Info {"message":"demo execution ended","level":"Information","logType":"Default","timeStamp":"2018-04-03T17:44:09.0053892+05:30","fingerprint":"546c70db-36c5-4ddf-bef5-473256331c88","windowsIdentity":"yuvaraja.kannan","machineName":"IN1LT0922","processName":"demo","processVersion":"1.0.6665.35345","fileName":"Extract\_load\_in\_parallel\_v1.0","jobId":"f302372f-ab80-4eee-a963-614a8c005bf7","robotName":"YUVARAJA.KANNAN","totalExecutionTimeInSeconds":34,"totalExecutionTime":"00:00:34"}

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [April 5, 2018, 1:01pm UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920/2 "2018-04-05T13:01:21Z")

</div>

Websites like regex101 are nice to test expressions for tasks like that. But if you need more fields, a json filter might be more helpful.

`\"processName\":\"(?<process_name>[^\"]*).*\"totalExecutionTime\":\"(?<total_execution>[^\"]*)`

---

<div class="post-metadata">

**Author:** ![Yuvaraja\_kannan](https://avatars.discourse-cdn.com/v4/letter/y/ba8739/32.png) [@Yuvaraja\_kannan](https://discuss.elastic.co/u/Yuvaraja_kannan)\
**Post date:** [April 11, 2018, 8:37am UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920/3 "2018-04-11T08:37:59Z")

</div>

HI Jenni, Thanks for your input, I tried with JSON filter, but it only produces if my log file is in this format, i.e. without the timestamp and info at the starting,  
{"message":"demo execution ended","level":"Information","logType":"Default","timeStamp":"2018-04-03T17:44:09.0053892+05:30","fingerprint":"546c70db-36c5-4ddf-bef5-473256331c88","windowsIdentity":"yuvaraja.kannan","machineName":"IN1LT0922","processName":"demo","processVersion":"1.0.6665.35345","fileName":"Extract\_load\_in\_parallel\_v1.0","jobId":"f302372f-ab80-4eee-a963-614a8c005bf7","robotName":"YUVARAJA.KANNAN","totalExecutionTimeInSeconds":34,"totalExecutionTime":"00:00:34"}

input { stdin { } }

filter {  
json {  
source =\> "message"  
target =\> "parsed"  
}  
}  
output { stdout { codec =\> rubydebug }}

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [April 11, 2018, 9:11am UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920/4 "2018-04-11T09:11:21Z")

</div>

Well, you could get rid of that with [gsub](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub) and a pattern like `^[^\{]*`.  
Did my suggestion for a grok pattern that only extracts the two desired fields work for you?

---

<div class="post-metadata">

**Author:** ![Yuvaraja\_kannan](https://avatars.discourse-cdn.com/v4/letter/y/ba8739/32.png) [@Yuvaraja\_kannan](https://discuss.elastic.co/u/Yuvaraja_kannan)\
**Post date:** [April 11, 2018, 9:25am UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920/5 "2018-04-11T09:25:18Z")

</div>

OK Jenni, let me try the gsub thing. No actually for now I extracted all the fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2018, 9:25am UTC](https://discuss.elastic.co/t/logstash-parsing-help-custom-log/126920/6 "2018-05-09T09:25:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.