# Need help for creating filter pattern based on custom logs

**URL:** <https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347>\
**Category:** Logstash\
**Created:** [December 2, 2022, 10:02am UTC](https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347 "2022-12-02T10:02:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shrikant\_Dhawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shrikant_dhawale/32/114148_2.png) [@Shrikant\_Dhawale](https://discuss.elastic.co/u/Shrikant_Dhawale)\
**Post date:** [December 2, 2022, 10:02am UTC](https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347/1 "2022-12-02T10:02:55Z")

</div>

Hi All,  
I am new to this technology started learning, need help in writing filter plugin which will parse custom logs from the server.

External User(dummy-user) is Mapped to Temp User(dummy-user) with Role(s): role1 role2  
10.100.200.300 - dummy-user [30/Nov/2022:11:03:44 -0600] "GET / HTTP/1.1" 200 93631 - "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"  
10.100.200.300 - dummy-user [30/Nov/2022:11:03:44 -0600] "GET / HTTP/1.1" 200 93631 - "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"  
10.100.200.300 - dummy-user [30/Nov/2022:11:03:44 -0600] "GET / HTTP/1.1" 200 93631 - "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"  
External User(dummy-user) is Mapped to Temp User(dummy-user) with Role(s): role1 role2

server is creating log line like above, I have written grok pattern for standard access log but whenever external user string is coming it is getting rejected of course it is not in the pattern

Need help how I can match grok filter pipeline based on these two pattern

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2022, 10:03am UTC](https://discuss.elastic.co/t/need-help-for-creating-filter-pattern-based-on-custom-logs/320347/2 "2022-12-30T10:03:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.