# Need help on the correct logstash.conf settings for processing a Log4Net file

**URL:** <https://discuss.elastic.co/t/need-help-on-the-correct-logstash-conf-settings-for-processing-a-log4net-file/40335>\
**Category:** Logstash\
**Created:** [January 28, 2016, 8:26am UTC](https://discuss.elastic.co/t/need-help-on-the-correct-logstash-conf-settings-for-processing-a-log4net-file/40335 "2016-01-28T08:26:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![harryw](https://avatars.discourse-cdn.com/v4/letter/h/977dab/32.png) [@harryw](https://discuss.elastic.co/u/harryw)\
**Post date:** [January 28, 2016, 8:26am UTC](https://discuss.elastic.co/t/need-help-on-the-correct-logstash-conf-settings-for-processing-a-log4net-file/40335/1 "2016-01-28T08:26:35Z")

</div>

Hi All.

I need to process a Log4Net file containing the following information;  
############################################  
LOG STARTED 2016-01-12 10:05:23,181  
############################################  
2016-01-28 00:00:00,000 [PhoenixInstance\_Worker-8] DEBUG UNK0000T RetrieveAcceptorFilesJob - RetrieveAcceptorFiles: [Begin]  
2016-01-28 00:00:00,000 [PhoenixInstance\_Worker-8] INFO UNK0000O AcceptorFileRetrievalService - RWWA.Services.Proxies.AcceptorFileRetrieval.AutoRetrieveAcceptorFilesRequest : [Begin]  
2016-01-28 00:00:00,000 [PhoenixInstance\_Worker-8] INFO UNK0000O ConnectionWrapper - Request type RWWA.Services.Proxies.AcceptorFileRetrieval.AutoRetrieveAcceptorFilesRequest - Created an oracle connection  
2016-01-28 00:00:00,000 [PhoenixInstance\_Worker-8] DEBUG UNK0000T AutoRetrieveImpl - AutoRetrieveImpl: [Begin]  
2016-01-28 00:00:00,000 [PhoenixInstance\_Worker-8] INFO UNK0000O AutoRetrieveImpl - True : [Begin]  
2016-01-28 00:00:00,000 [PhoenixInstance\_Worker-8] INFO UNK0000O AutoRetrieveImpl - Request type System.Boolean - Created an oracle transaction  
2016-01-28 00:00:00,016 [PhoenixInstance\_Worker-8] DEBUG UNK0000T OracleAfrRepository - DbmsTryLock: dbms\_lock.request: handle 1073741946107374194630  
2016-01-28 00:00:00,016 [PhoenixInstance\_Worker-8] DEBUG UNK0000T OracleAfrRepository - DbmsTryLock: dbms\_lock.request: return 0  
2016-01-28 00:00:00,016 [PhoenixInstance\_Worker-8] INFO UNK0000O AutoRetrieveImpl - True : [End]  
2016-01-28 00:00:00,016 [PhoenixInstance\_Worker-8] INFO UNK0000O AutoRetrieveImpl - RWWA.Services.Proxies.AcceptorFileRetrieval.ListExternalDirectoryRequest : [Begin]  
2016-01-28 00:00:00,016 [PhoenixInstance\_Worker-8] INFO UNK0000O AutoRetrieveImpl - Request type RWWA.Services.Proxies.AcceptorFileRetrieval.ListExternalDirectoryRequest - Created an oracle transaction  
2016-01-28 00:00:00,016 [PhoenixInstance\_Worker-8] DEBUG UNK0000T FtpFileTransferAgent - [Ftp.ListDirectory] : ftp://rawdphc101v.rwwaq.com.au/AFR\_FTP\_TEST\_AREA/  
2016-01-28 00:00:00,109 [PhoenixInstance\_Worker-8] DEBUG UNK0000T FtpFileTransferAgent - [Ftp.GetDateTimestamp] : ftp://rawdphc101v.rwwaq.com.au/AFR\_FTP\_TEST\_AREA/20100322 Armidale NSW - Professional, FinalFields.xml  
2016-01-28 00:00:00,109 [PhoenixInstance\_Worker-8] DEBUG UNK0000T FtpFileTransferAgent - [Ftp.GetFileSize] : ftp://rawdphc101v.rwwaq.com.au/AFR\_FTP\_TEST\_AREA/20100322 Armidale NSW - Professional, FinalFields.xml

As you can see there is one line per entry with a space separating each value on the first two values being a date and time.  
I can ignore all items without a valid date and time value.

Any help would be greatly appreciated.

Regards,  
Harry W.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 28, 2016, 8:51pm UTC](https://discuss.elastic.co/t/need-help-on-the-correct-logstash-conf-settings-for-processing-a-log4net-file/40335/2 "2016-01-28T20:51:30Z")

</div>

Have a look at [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/). It's a great help when writing grok expressions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/need-help-on-the-correct-logstash-conf-settings-for-processing-a-log4net-file/40335/3 "2017-07-06T05:13:52Z")

</div>

Closed on July 6, 2017, 5:13am UTC