# Not able to parse http version from weblogic access log in logstash configuration

**URL:** <https://discuss.elastic.co/t/not-able-to-parse-http-version-from-weblogic-access-log-in-logstash-configuration/53639>\
**Category:** Logstash\
**Created:** [June 22, 2016, 9:40am UTC](https://discuss.elastic.co/t/not-able-to-parse-http-version-from-weblogic-access-log-in-logstash-configuration/53639 "2016-06-22T09:40:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kunalp](https://avatars.discourse-cdn.com/v4/letter/k/59ef9b/32.png) [@kunalp](https://discuss.elastic.co/u/kunalp)\
**Post date:** [June 22, 2016, 9:40am UTC](https://discuss.elastic.co/t/not-able-to-parse-http-version-from-weblogic-access-log-in-logstash-configuration/53639/1 "2016-06-22T09:40:57Z")

</div>

Here is my configuration file.

* * *

input{  
file{  
path =\> "/home/kunal/Desktop/log/accessWeblogic.log"  
start\_position =\> beginning  
ignore\_older =\> 0  
}  
}  
filter{  
grok{  
match =\> { "message" =\> " %{IP:cleintIP} - - [(?%{MONTHDAY}[/]%{MONTH}[/]%{YEAR}:%{TIME}\s+%{ISO8601\_TIMEZONE})] "%{WORD:method} %{URIPATHPARAM:uri}\s+HTTP.+?" %{NUMBER:status} %{NUMBER:bytes}"}  
}

```
    date{

    match => ["timestamp" ,"dd/MMM/yyyy:HH:mm:ss Z"]
    }

```

}  
output{

```
    elasticsearch{}
    stdout{ codec => rubydebug }

```

}

* * *

After executing the logstash I am getting grok failure under tag.Below is the output for logstash command

===================================

/ELK/logstash-2.2.2/bin$ ./logstash -f weblogicAccesspattern.conf  
Settings: Default pipeline workers: 1  
Logstash startup completed  
{  
"message" =\> ":34c3:90a4:9e3b - - [15/May/2016:12:16:23 +0530] "GET /favicon.ico HTTP/1.1" 404 1164",  
"@version" =\> "1",  
"@timestamp" =\> "2016-06-22T09:33:59.626Z",  
"path" =\> "/home/kunal/Desktop/log/accessWeblogic.log",  
"host" =\> "kunal-VirtualBox",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}

===================================  
Below are the log entries for which I am trying to get the log analyis

0:0:0:0:0:0:0:1 - - [03/Apr/2016:10:35:57 +0530] "GET /favicon.ico HTTP/1.1" 404 1164

I tried to use apache log format but error is coming on " "

Regards,  
Kunal

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 4, 2016, 6:47pm UTC](https://discuss.elastic.co/t/not-able-to-parse-http-version-from-weblogic-access-log-in-logstash-configuration/53639/2 "2016-07-04T18:47:06Z")

</div>

Your grok expression appears to begin with a space. Remove it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/not-able-to-parse-http-version-from-weblogic-access-log-in-logstash-configuration/53639/3 "2017-07-06T04:49:39Z")

</div>