# Parse Audit file

**URL:** <https://discuss.elastic.co/t/parse-audit-file/140479>\
**Category:** Logstash\
**Created:** [July 18, 2018, 8:23am UTC](https://discuss.elastic.co/t/parse-audit-file/140479 "2018-07-18T08:23:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Serak\_Shiferaw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/serak_shiferaw/32/75697_2.png) [@Serak\_Shiferaw](https://discuss.elastic.co/u/Serak_Shiferaw)\
**Post date:** [July 18, 2018, 8:23am UTC](https://discuss.elastic.co/t/parse-audit-file/140479/1 "2018-07-18T08:23:32Z")

</div>

Hi All i wanted a specif patter of filter and i cant get my head arround it because my columns are not uniform

for example i have line like  
Format  
`TimeStamp || BusinessTimeStamp ||RuntimeMicroflowID ||MicroflowID ||UserId ||ClientId ||Userlocation ||Transactionid ||Catagorie ||EventType ||Operation ||PrimaryData ||SecondayData || < Other Data >`

then comes the tricky part the first 13 columns are fixed values always ... the other \< Other Data \> part is `KEY || OLDVALUE || NEWVALUE` , ..... this pattern repeats with every 3 column

in java this is what i did

```
        for (int i = 13; i < column.length; i += 3) {
                            System.out.println(column[i]+ column[(i + 1)]+column[(i + 2)]);
                        }

```

Sample Data  
1.  
`2017.10.31/08:03:28.542||2017.10.31/08:03:28.542||'015f70cfa0b11VKG%27059'||'CB_CMN_ReadCurrency_SRV'||'alemugem'||'UXP'||'00001015'||''||'MicroFlow'||'Finished'||''||''||''||'CurrentThread'||'WebContainer : 23'||''||'ParentThread'||'system'||''`  
2.  
`2017.10.31/08:09:26.405||2017.10.31/08:09:26.405||'015f70d5944e2RO0%43399'||'ApproveReferral'||'shambelg'||'UXP'||'00001028'||'015f70d594cf2RP3'||'Persistence'||''||'CREATE'||'Task'||'015f70d594d72RP9'||'CurrentThread'||'WebContainer : 6'||''||'ParentThread'||'system'||''||'versionNum'||'0'||''||'f_MICROFLOWID'||'ApproveReferral'||''||'f_RUNTIMEMICROFLOWID'||'015f70d5944e2RO0%43399'||''||'f_ZONE'||'BF'||''||'f_STATUS'||'Open'||''||'f_PAYLOAD'||$BLOB_015f70d595052RPf||''||'f_ORIGINALTASKID'||''||''||'f_BUSINESSMFNAME'||''||''||'f_ALLCOMMENTS'||'; Supervisor authorization required for Creating Account Alerts'||''||'f_RAISEDAT'||'2017-10-31 08:09:26.358'||''||'f_TYPE'||'Approval'||''||'f_CHANNELTYPE'||'UXP'||''||'f_ALERTAT'||'2017-10-31 09:09:26.358'||''||'f_COMMENT'||''||''||'f_TASKLISTID'||'015f70ca8a4c0y4I'||''||'f_PROCESSEDAT'||'2017-10-31 08:09:26.358'||''||'f_ALERTTASKNAME'||''||''||'f_RAISEDBY'||'shambelg'||''||'f_DETAILS'||$BLOB_015f70d595052RPg||''||'f_PROCESSEDBY'||''||''||'f_TASKNAME'||'business.approval'||''`

Regards  
Serak

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2018, 8:23am UTC](https://discuss.elastic.co/t/parse-audit-file/140479/2 "2018-08-15T08:23:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.