# Multiple timestamped log file format **URL:** \ **Category:** Logstash\ **Created:** [April 1, 2019, 9:57am UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754 "2019-04-01T09:57:24Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![markov](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@markov](https://discuss.elastic.co/u/markov)\ **Post date:** [April 1, 2019, 9:57am UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/1 "2019-04-01T09:57:24Z")
Hi, i have two timestamped log file names "server\_log11032019", "app\_log11032019" and in one of those log file there is multiple format for example(app\_log) : 2019-03-11 10:53:55,741 ERROR [com.website.classname] Error\_msg Java\_exception 2019-03-11 10:53:55,741 ERROR [com.website.classname] ORACLE\_DB\_ERR . . i think the filter will be like this : filter { if [type] == "server\_log" { grok { match =\> {"message" =\> "%{AAA\_FILE\_NAME}"} } } else if [type] == "app\_log" { grok{ match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:Loglevel} [(?[^]]+)] %{WORD:Message d'erreur}(?\[^]]+)"} match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:Loglevel} [(?\[^]]+)] (?\[^]]+)"} } } } can we do that ? ---
**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Post date:** [April 1, 2019, 4:54pm UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/2 "2019-04-01T16:54:45Z")
Yes, you can have multiple matches inside of a grok. You could handle this using an or clause in your regex (|) ```auto grok { match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:Loglevel}( [(?[^]]+)] %{WORD:Message d'erreur}(?<exception'>[^]]+))|([(?<classnamee'>[^]]+)] (?<mssg'>[^]]+))"} } ``` You can use the | as an or clause in your regex. Another way to handle it would be to do an if else if ```auto if "Error_msgJava_Exception" in [message] { grok { match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:Loglevel} [(?[^]]+)] %{WORD:Message d'erreur}(?[^]]+)"} } } else if "ORACLE_DB_ERR" in [message] { grok { match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:Loglevel} [(?[^]]+)] (?[^]]+)"} } } ``` Are you running into an error or are you just trying to come up with the best way of handling it? If you want suggestions for handling multiple scenarios, then we would need a longer log example to play with so that we can make better suggestions. In my case I use the "if else if" a lot for breaking up my logs. Usually I only have a handful of unique log types in a single file that I need to process. ---
**Author:** ![markov](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@markov](https://discuss.elastic.co/u/markov)\ **Post date:** [April 2, 2019, 10:54am UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/3 "2019-04-02T10:54:00Z")
what about the files names "app\_log","server\_log", because i have the two files in the same folder how i can write the condition ? if [path/source/type] what keyword we use for that ? thank you. ---
**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Post date:** [April 2, 2019, 4:31pm UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/4 "2019-04-02T16:31:00Z")
Have you checked your output from processing a log? You should have something like ["log"]["file"]["path"] that you can use to pull the name of your log file and do an if else if on that. ```auto if { "server_log" in ["log"]["file"]["path"] { do stuff } } ``` Please note I did not test the above code, this is just off the top of my head to point you in the correct direction. ---
**Author:** ![markov](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@markov](https://discuss.elastic.co/u/markov)\ **Post date:** [April 3, 2019, 9:49am UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/5 "2019-04-03T09:49:59Z")
the first solution is not suitable for my case, and for the second one i have a log file that contains multiple log format and i can't make "if else if" for all of them any other suggestions !! ---
**Author:** ![kharvey](https://avatars.discourse-cdn.com/v4/letter/k/d07c76/32.png) [@kharvey](https://discuss.elastic.co/u/kharvey)\ **Post date:** [April 3, 2019, 3:58pm UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/6 "2019-04-03T15:58:12Z")
Can you give some more examples then? I'm not sure what you are trying to do. If you want to process different files in different ways then you will have to have a conditional somewhere. That or you have to a different port for every log file that you process. You can also do pipeline to pipeline processing. That way your conditionals sit either in your pipelines.yml or into a routing pipeline. ---
**Author:** ![markov](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@markov](https://discuss.elastic.co/u/markov)\ **Post date:** [April 8, 2019, 10:25am UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/7 "2019-04-08T10:25:35Z")
it's working using this : ``` if [source] =~ "server_log" { grok { match => {"message" => "%{TIMESTAMP_ISO8601:Timestamp}\|(\[%{BASE10$ } } else if [source] =~ "app_log" { grok { match =>{ "message" => ["%{TIMESTAMP_ISO8601:Timestamp}.......","%{TIMESTAMP_ISO8601:Timestamp}.......", ...]} } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 6, 2019, 10:25am UTC](https://discuss.elastic.co/t/multiple-timestamped-log-file-format/174754/8 "2019-05-06T10:25:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.