# Metatrader, how parse this?

**URL:** <https://discuss.elastic.co/t/metatrader-how-parse-this/201982>\
**Category:** Logstash\
**Created:** [October 2, 2019, 3:01pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982 "2019-10-02T15:01:45Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![immo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/immo/32/55251_2.png) [@immo](https://discuss.elastic.co/u/immo)\
**Post date:** [October 2, 2019, 3:01pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982/1 "2019-10-02T15:01:45Z")

</div>

Hello! Iam new there, and have some problems with log.  
Main problem - log have not only same lines, so i just cant grok it.

Here is an example:

> EL 0 4 23:36:56.041 Glfx mt5 live\_capital\_m datafeed process start completed (127.0.0.1:16389)  
> PS 0 3 23:36:57.168 127.0.0.1 connected to 127.0.0.1:16389  
> OL 0 3 23:36:57.178 Glfx mt5 live\_capital\_m '4': connected to '127.0.0.1:16389'  
> QO 0 2 23:37:01.314 Monitor connections: 8, cpu: 1%, process cpu: 0%, threads: 718, process threads: 50, handles: 16605, process handles: 1568, disk queue: 0

So what can i do? I can just pull full message, but it makes no sense. Help me pls, great thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 2, 2019, 3:09pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982/2 "2019-10-02T15:09:48Z")

</div>

What do you want to get out of those messages?

---

<div class="post-metadata">

**Author:** ![immo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/immo/32/55251_2.png) [@immo](https://discuss.elastic.co/u/immo)\
**Post date:** [October 2, 2019, 3:14pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982/3 "2019-10-02T15:14:04Z")

</div>

something like - [name] [id] [level] [time] [ip] [message]

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 2, 2019, 3:42pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982/4 "2019-10-02T15:42:24Z")

</div>

Only one of those events seems to have the [ip] component, so you can use a grok filter where that field is optional:

```
grok { match => { "message" => "^%{WORD:name} %{NUMBER:id:int} %{NUMBER:level:int} (?<time>[0-9:\.]+)( %{IP:ip})?%{GREEDYDATA:msg}" } }
```

---

<div class="post-metadata">

**Author:** ![immo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/immo/32/55251_2.png) [@immo](https://discuss.elastic.co/u/immo)\
**Post date:** [October 3, 2019, 6:38am UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982/5 "2019-10-03T06:38:01Z")

</div>

> [@immo](#):
>
> PS 0 3 23:36:57.168 127.0.0.1 connected to 127.0.0.1:16389

thanks you! works great, can you explain one thing? for what we need  
specify data type "NUMBER:level: **INT**"? And what if some field ll be empty? Ty again!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 3, 2019, 1:27pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982/6 "2019-10-03T13:27:03Z")

</div>

Converting the numbers to "int" is optional. It is sometimes useful so that you can aggregate them in elasticsearch. For example, in web server logs converting the number of bytes sent in response to a request to int makes sense, since that allows you to calculate things like the average response size, or the total bandwidth used. Converting the port number used to int is not helpful, since such aggregations generally make no sense.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2019, 1:27pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982/7 "2019-10-31T13:27:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.