# LogStatsh- Grok Filter for Special character in the log file

**URL:** <https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360>\
**Category:** Logstash\
**Created:** [February 18, 2018, 5:11pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360 "2018-02-18T17:11:41Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bheeshma](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\
**Post date:** [February 18, 2018, 5:11pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/1 "2018-02-18T17:11:41Z")

</div>

Hi,

I have the below log pattern in a single line and trying to filter this from massive log using GROK FIlter

2018-02-17 17:00:12.7280 Information |||| Application: Hyperion |||| User: Teddy |||| Template: Homepage |||| Report: FINREP |||| ExecutionTime: 200 ms

I have used this below grok filter however ( havent build the complete grok yet) however it couldn't identify how to filer the special Character |||| from this; could you please advise on how to capture the special characters |||| please

%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}%{WORD:Info}%{SPACE}%{QUOTEDSTRING}

from GROK Match Constructor:

2018-02-17 17:00:12.7280 Information |||| Application: Hyperion |||| User: Teddy |||| Template: Homepage |||| Report: FINREP |||| ExecutionTime: 200 ms

NOT MATCHED. The longest regex prefix matching the beginning of this line is as follows:

prefix %{TIMESTAMP\_ISO8601:timestamp}%{SPACE}%{WORD:Info}%{SPACE}  
timestamp 2018-02-17·17:00:12.7280  
Info Information  
after match: |||| Application: Hyperion |||| User: Teddy |||| Template:  
Homepage |||| Report: FINREP |||| ExecutionTime: 200 ms

Have used this pattern too but it is not working either;

%{TIMESTAMP\_ISO8601:timestamp} %{WORD:Info} |||| %{WORD:Application} |||| %{USERNAME:user}

Thanks  
Bheeshma.

---

<div class="post-metadata">

**Author:** ![Bheeshma](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\
**Post date:** [February 19, 2018, 11:38pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/2 "2018-02-19T23:38:31Z")

</div>

2018-02-17 17:00:12.7280 Information |||| Application: Hyperion |||| User: Teddy |||| Template: Homepage |||| Report: FINREP |||| ExecutionTime: 200 ms

With the help of [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) website, tried to build the grok filter upto 2018-02-17 17:00:12.7280 Information ||||

%{TIMESTAMP\_ISO8601:timestamp} %{WORD:Info} %{SPACE}|%{NOTSPACE}|%{NOTSPACE}

and here is the match but unfortunately, It couldn't match the |||| so couldn't move proceed further; can you please review and help on how match the special characters |||| and complete the entire grok filter for the line

{  
"timestamp": [  
[  
"2018-02-17 17:00:12.7280"  
]  
],  
"YEAR": [  
[  
"2018"  
]  
],  
"MONTHNUM": [  
[  
"02"  
]  
],  
"MONTHDAY": [  
[  
"17"  
]  
],  
"HOUR": [  
[  
"17",  
null  
]  
],  
"MINUTE": [  
[  
"00",  
null  
]  
],  
"SECOND": [  
[  
"12.7280"  
]  
],  
"ISO8601\_TIMEZONE": [  
[  
null  
]  
],  
"Info": [  
[  
"Information"  
]  
],  
"SPACE": [  
[  
""  
]  
],  
"NOTSPACE": [  
[  
"|",  
"|"  
]  
]  
}

---

<div class="post-metadata">

**Author:** ![Bheeshma](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\
**Post date:** [February 20, 2018, 3:49pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/3 "2018-02-20T15:49:47Z")

</div>

Hi Gurus,

I am really newbie so really finding hard to understand how GROK works..I really need your advise how to achieve and match to the LOG details and produce accurate results which helps for diagnosing performance issues we have currently.

My apologies if I am nagging , just need small push and advise from this forum.

Kind Regards  
Bheeshma.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2018, 8:15pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/4 "2018-02-20T20:15:33Z")

</div>

Always format snippet from logs and configurations as preformatted text using the `</>` toolbar button. Otherwise we won't be able to see exactly what e.g. your grok expression looks like. Specifically, are you escaping the `|` characters with a backslash?

---

<div class="post-metadata">

**Author:** ![Bheeshma](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\
**Post date:** [February 22, 2018, 5:19pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/5 "2018-02-22T17:19:23Z")

</div>

Thanks Magnus for the reply; Here is the line which I have been trying to match and filter out from the massive log.  
\<  
2018-02-17 17:00:12.7280 Information |||| Application: Hyperion |||| User: Teddy |||| Template: Homepage |||| Report: FINREP |||| ExecutionTime: 200 ms

/\>

And this is the GROK filter trying to write to match to the above  
\<  
%{TIMESTAMP\_ISO8601:timestamp} %{WORD:Info} %{SPACE}|%{NOTSPACE}|%{NOTSPACE}

/\>

Basically I am stuck how to escape the special character |.

Kindly advise.

Thanks  
Bheeshma.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 22, 2018, 9:55pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/6 "2018-02-22T21:55:52Z")

</div>

I repeat: Always format snippets from logs and configurations as preformatted text using the \</\> toolbar button.

> Basically I am stuck how to escape the special character |.

Did you try with `\|`?

---

<div class="post-metadata">

**Author:** ![Bheeshma](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\
**Post date:** [March 16, 2018, 2:14pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/7 "2018-03-16T14:14:04Z")

</div>

This is how the log looks like :

2018-02-17 17:00:15.9105 Information |||| Application: P&L |||| User: Admin |||| Template: P&L |||| Report: P&L Report |||| ExecutionTime: 952 ms

And here is how wanted to view this data in Kibana and then generate the report depend on the name of the report and execution time it took

Timestamp 2018-02-17 17:00:15.9105  
Info Information  
Application: P&L  
User: Admin  
Template: P&L  
Report: P&L Report  
ExecutionTime: 952 ms

I tried several times to achieve the above result but ended up till here only which is not yielding any results.

\<  
filter {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} \s %{WORD:Info} %{WORD:Application} %{USERNAME} %{WORD:Template} %{WORD:Report}" }  
}  
}  
/\>

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 16, 2018, 3:01pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/8 "2018-03-16T15:01:30Z")

</div>

You're apparently ignoring what I am saying so perhaps you should try using the grok constructor site to get help coming up with a grok expression.

---

<div class="post-metadata">

**Author:** ![Bheeshma](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\
**Post date:** [March 16, 2018, 4:10pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/9 "2018-03-16T16:10:53Z")

</div>

Hi Magnus,

I really beg your pardon , not doing it intentionally; probably not getting or understanding how to report about the issue over here.

However, I tried this option and it worked and the entire message

" 2018-02-17 17:00:15.9105 Information |||| Application: P&L |||| User: Admin |||| Template: P&L |||| Report: P&L Report |||| ExecutionTime: 952 ms "

is appearing in Kibana web.

```
        filter {
            grok {
                  match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}
                   }}

```

However, from this message, I want to filter out Report Name and the Execution time and populate in Kibana under Y & X axis.

is it possible to filter the Report name and the execution details from the message from Kibana -\> Discover and then visualize in a pictorial representation?

Please advise.

thanks  
Bheeshma.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2018, 4:11pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360/10 "2018-04-13T16:11:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.