# Need help with grok filtering **URL:** \ **Category:** Logstash\ **Created:** [August 1, 2018, 2:37pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596 "2018-08-01T14:37:05Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 1, 2018, 2:37pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/1 "2018-08-01T14:37:05Z")
Hello everyone im working for several few days on loggind the f5 Big Data with Elk but the parsing of log its not working at all on logstash with Grok (and i don't find the patterns necesary for this), how would you match this "message" field to separate every field?: Log example: Aug 1 11:28:54 f5\_01 info tmm1[18879]: Rule /dnsfrontend/iRule\_loggingApache \: 10.68.208.116 01/08/2018 11:28:54 -0300 4 "POST /wsregistro/rest/consulta" 200 "" "" Grok example: # match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_$ This is going from F5 Big Data to a Red Hat vm and then by rsyslog and then gets re send to remote ELK from filebeat Kind regards and i hope this gets understoud since English its not my first lenguage. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2018, 3:23pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/2 "2018-08-01T15:23:23Z")
> [@Victor\_Musa](#): > > Aug 1 11:28:54 f5\_01 info tmm1[18879]: Rule /dnsfrontend/iRule\_loggingApache \: 10.68.208.116 01/08/2018 11:28:54 -0300 4 "POST /wsregistro/rest/consulta" 200 "" "" If lines always look like that I would use dissect, not grok. This might work... ``` dissect { mapping => { "message" => '%{ts1} %{+ts1} %{+ts1} %{hostname} %{loglevel} %{program}[%{pid}]: %{w1} %{w2} %{w3}: %{ip} %{ts2} %{+ts2} %{+ts2} %{n1} "%{req}" %{response} "" ""%{}' } } ``` However, if the 'Rule /dnsfrontend/iRule\_loggingApache \: ' part varies that might not work and you might have to grok it. ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 1, 2018, 4:06pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/3 "2018-08-01T16:06:37Z")
First thanks a lot for your response, the problem is that "dnsfrontend" refers to the app and the "iRule\_loggingApache" its only the name of the IRULE on f5 big data that it will allways be the same, the problem is that in the future i need it to get filtered by appname so we can separate in kibana the request/responses by app. Regards and thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2018, 4:28pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/4 "2018-08-01T16:28:11Z")
OK, so something like ``` dissect { mapping => { "message" => '%{ts1} %{+ts1} %{+ts1} %{hostname} %{loglevel} %{program}[%{pid}]: %{w1} /%{appname}/%{rulename} %{w3}: %{ip} %{ts2} %{+ts2} %{+ts2} %{n1} "%{req}" %{response} "" ""%{}' } } ``` ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 1, 2018, 5:22pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/5 "2018-08-01T17:22:45Z")
Really thanks a lot with that disection i was abble to separate every app by the field rulename. Thanks a lot again, Victor. ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 8, 2018, 2:52pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/6 "2018-08-08T14:52:52Z")
So finally i need this to be filter by grok, any advice or help you can give me? im triying since a few days already ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 8, 2018, 2:54pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/7 "2018-08-08T14:54:41Z")
Also i need the "ts" fields to be merged together ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 8, 2018, 3:19pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/8 "2018-08-08T15:19:56Z")
> [@Victor\_Musa](#): > > Also i need the "ts" fields to be merged together In dissect that is what "%{ts1} %{+ts1} %{+ts1}" and "%{ts2} %{+ts2} %{+ts2}" do, the three are merged into a single field. ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 8, 2018, 3:34pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/9 "2018-08-08T15:34:57Z")
it didn't work than because all 3 are separated fields and i want all that information to be together but i need the grok working cause i want the timestamp to be replaced by this ts fields ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 8, 2018, 3:36pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/10 "2018-08-08T15:36:55Z")
What are the three separate fields called? ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 8, 2018, 3:37pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/11 "2018-08-08T15:37:57Z")
this is how i see it on "discover" in Kibana: |t ts| |Aug | |t ts1| |8| |t ts2| |08/08/2018 12:37:19 -0300| ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 8, 2018, 3:59pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/12 "2018-08-08T15:59:39Z")
> [@Badger](#): > > "%{ts1} %{+ts1} %{+ts1}" Originally my post had a typo: "%{ts} %{+ts1} %{+ts1}". If you change the ts to be ts1 it should work. ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 8, 2018, 5:35pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/13 "2018-08-08T17:35:44Z")
Still the discover: |t ts| |Aug| |t ts1| | 8| |t ts2| |08/08/2018 14:34:49 -0300| =( ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 8, 2018, 5:36pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/14 "2018-08-08T17:36:47Z")
If you are still seeing ts in newly ingested events then you have not updated the dissect filter. ---
**Author:** ![Victor\_Musa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_musa/32/33963_2.png) [@Victor\_Musa](https://discuss.elastic.co/u/Victor_Musa)\ **Post date:** [August 8, 2018, 5:44pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/15 "2018-08-08T17:44:06Z")
this is how its now: dissect { mapping =\> { "message" =\> '%{ts} %{+ts1} %{+ts1} %{hostname} %{loglevel} %{program}[%{pid}]: %{w1} /%{appname}/%{rulename} %{w3}: %{ip} %{ts2} %{+ts2} %{+ts2} %{n1} "%{req}" %{response} "" ""%{}' } } and then i restarted the logstash service but that's what is showing the discover =(. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 8, 2018, 6:00pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/16 "2018-08-08T18:00:40Z")
> [@Victor\_Musa](#): > > %{ts} %{+ts1} %{+ts1} You need to change that to %{ts **1** } %{+ts1} %{+ts1} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 5, 2018, 6:09pm UTC](https://discuss.elastic.co/t/need-help-with-grok-filtering/142596/17 "2018-09-05T18:09:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.