# Optimal way to handle log with multiple format?

**URL:** <https://discuss.elastic.co/t/optimal-way-to-handle-log-with-multiple-format/344470>\
**Category:** Logstash\
**Created:** [October 5, 2023, 10:33am UTC](https://discuss.elastic.co/t/optimal-way-to-handle-log-with-multiple-format/344470 "2023-10-05T10:33:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tanin\_Imanothai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanin_imanothai/32/123397_2.png) [@Tanin\_Imanothai](https://discuss.elastic.co/u/Tanin_Imanothai)\
**Post date:** [October 5, 2023, 10:33am UTC](https://discuss.elastic.co/t/optimal-way-to-handle-log-with-multiple-format/344470/1 "2023-10-05T10:33:57Z")

</div>

I try to parse this dataset: [https://github.com/logpai/loghub/tree/master/Android](https://github.com/logpai/loghub/tree/master/Android) using logstash.  
I have tried using grok filter but some parts of the log contains multiple templates.

example of log:

```auto
03-17 16:13:38.811 1702 2395 D WindowManager: printFreezingDisplayLogsopening app wtoken = AppWindowToken{9f4ef63 token=Token{a64f992 ActivityRecord{de9231d u0 com.tencent.qt.qtl/.activity.info.NewsDetailXmlActivity t761}}}, allDrawn= false, startingDisplayed = false, startingMoved = false, isRelaunching = false
03-17 16:13:38.819 1702 8671 D PowerManagerService: acquire lock=233570404, flags=0x1, tag="View Lock", name=com.android.systemui, ws=null, uid=10037, pid=2227
03-17 16:13:38.820 1702 8671 D PowerManagerService: ready=true,policy=3,wakefulness=1,wksummary=0x23,uasummary=0x1,bootcompleted=true,boostinprogress=false,waitmodeenable=false,mode=false,manual=38,auto=-1,adj=0.0userId=0
03-17 16:13:38.839 1702 2113 V WindowManager: Skipping AppWindowToken{df0798e token=Token{78af589 ActivityRecord{3b04890 u0 com.tencent.qt.qtl/com.tencent.video.player.activity.PlayerActivity t761}}} -- going to hide
03-17 16:13:38.859 2227 2227 D TextView: visible is system.time.showampm

```

My grok filter:

```auto
filter {
	grok {
	patterns_dir => ["./patterns"]
	match => { "message" => "%{MONTHANDDAY:date}%{SPACE}%{TIME:time}%{SPACE}%{NUMBER:pid}%{SPACE}\
	%{NUMBER:tid}%{SPACE}%{WORD:level}%{SPACE}%{WORD:App}:%{SPACE}%{GREEDYDATA:INFO}" }
	}
}

```

Result: Logstash can handle log with same structure. How about the postfix with 100+ templates? Do I need to manually define grok pattern for each template or what is the correct tool for this?

 ![logstash output](https://us1.discourse-cdn.com/elastic/original/3X/3/6/363ff13c2ce9a382bfa1dead3dbc11218e2439ef.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2023, 10:34am UTC](https://discuss.elastic.co/t/optimal-way-to-handle-log-with-multiple-format/344470/2 "2023-11-02T10:34:39Z")

</div>

Closed on November 2, 2023, 10:34am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.