# Org.apache.cxf.services filtering in logstash

**URL:** <https://discuss.elastic.co/t/org-apache-cxf-services-filtering-in-logstash/170690>\
**Category:** Logstash\
**Created:** [March 4, 2019, 8:48am UTC](https://discuss.elastic.co/t/org-apache-cxf-services-filtering-in-logstash/170690 "2019-03-04T08:48:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Primeval](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@Primeval](https://discuss.elastic.co/u/Primeval)\
**Post date:** [March 4, 2019, 8:48am UTC](https://discuss.elastic.co/t/org-apache-cxf-services-filtering-in-logstash/170690/1 "2019-03-04T08:48:29Z")

</div>

I have logs looking like this:

> [@Primeval](#):
>
> I have logs looking like this:
> 
> > ## 2019-02-06 03:17:28,156 INFO [org.apache.cxf.services.xyz] (default task-30) Inbound Message
> > 
> > ## ID: 509 Address: [http://xyz](http://xyz) Encoding: UTF-8 Http-Method: POST Content-Type: text/xml; charset=UTF-8 Headers: {Accept=[text/xml], Cache-Control=[no-cache], connection=[keep-alive], Content-Length=[1410], content-type=[text/xml; charset=UTF-8], Host=[xyz], Pragma=[no-cache], SFDC\_STACK\_DEPTH=[1], SOAPAction=[""], User-Agent=[xyz], X-Forwarded-For=[xyz], X-Forwarded-Port=[443], X-Forwarded-Proto=[https]} Payload: \<?xml version="1.0" encoding="UTF-8"?\>\<env:Envelope xmlns:env="[http://schemas.xmlsoap.org/soap/envelope/](http://schemas.xmlsoap.org/soap/envelope/)" xmlns:xsd="[http://www.w3.org/2001/XMLSchema](http://www.w3.org/2001/XMLSchema)" xmlns:xsi="[http://www.w3.org/2001/XMLSchema-instance](http://www.w3.org/2001/XMLSchema-instance)"\>\<env:Header /\>env:Body\</env:Body\>\</env:Envelope\>
> > 
> > ## 2019-02-06 03:17:30,718 INFO [org.apache.cxf.services.xyz] (default task-30) Outbound Message
> > 
> > ## ID: 509 Response-Code: 200 Encoding: UTF-8 Content-Type: text/xml Headers: {} Payload: \<soap:Envelope xmlns:soap="[http://schemas.xmlsoap.org/soap/envelope/](http://schemas.xmlsoap.org/soap/envelope/)"\>soap:Bodyxyz\</soap:Body\>\</soap:Envelope\>
> 
> I created very long multiline grok, and while it is working for few test messages, it is failing on bigger load.  
> Is there build in logstash filter or grok pattern defined for this type of logs? so I can filter this fields better than one by one, like this (for one of the event type):  
> match =\> { "message" =\> "(?m)%{TIMESTAMP\_ISO8601:timestamp}\s+%{LOGLEVEL:loglevel}\s+[%{DATA:class}]\s+(%{DATA:task})\s+%{GREEDYDATA:message1}((.|\r|\n)_)ID:%{SPACE}%{NUMBER:id}((.|\r|\n)_)Address:%{SPACE}%{GREEDYDATA:address}\nEncoding:%{SPACE}%{GREEDYDATA:encoding}\nHttp-Method:%{SPACE}%{DATA:http-method}((.|\r|\n)_)Content-Type:%{SPACE}%{DATA:content\_type}((.|\r|\n)_)Headers: {Accept=[%{DATA:headers.accept}], Cache-Control=[%{DATA:headers.cache-control}], connection=[%{DATA:headers.connection}], Content-Length=[%{DATA:headers.content-length}], content-type=[%{DATA:headers.content-type}], Host=[%{DATA:headers.host}], Pragma=[%{DATA:headers.pragma}], SFDC\_STACK\_DEPTH=[%{DATA:headers.sfdc\_stack\_depth}], SOAPAction=[?%{DATA:headers.soap\_action}], User-Agent=[%{DATA:headers.user-agent}], X-Forwarded-For=[%{DATA:headers.x-forwarded-for}], X-Forwarded-Port=[%{DATA:headers.x-forwarded-port}], X-Forwarded-Proto=[%{DATA:headers.x\_forwarded-proto}]}\nPayload:%{SPACE}%{GREEDYDATA:payload}\n" }  
> I know it so not very efficient, but I had problem with resolve this better.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 4, 2019, 1:26pm UTC](https://discuss.elastic.co/t/org-apache-cxf-services-filtering-in-logstash/170690/2 "2019-03-04T13:26:27Z")

</div>

You might be better off extracting one line in each grok pattern. Use a pattern that matches zero-or-more characters that are not newline followed by a newline.

```
    grok { match => { message => "^Headers: (?<Headers>[^
]*)
" } }

```

Then you can give the grok filter an array of patterns to match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2019, 1:32pm UTC](https://discuss.elastic.co/t/org-apache-cxf-services-filtering-in-logstash/170690/3 "2019-04-01T13:32:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.