# Parse log file with two formats in it

**URL:** https://discuss.elastic.co/t/parse-log-file-with-two-formats-in-it/166876
**Category:** Logstash
**Created:** [February 3, 2019, 5:54pm UTC](https://discuss.elastic.co/t/parse-log-file-with-two-formats-in-it/166876 "2019-02-03T17:54:29Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 3, 2019, 6:29pm UTC](https://discuss.elastic.co/t/parse-log-file-with-two-formats-in-it/166876/2 "2019-02-03T18:29:13Z")

</div>

This should give you an idea of how to do it. It drops comments and lines that are just whitespace. Then it parses key=value and stashes it in a class variable. Then it parses anything with multiple commas as a csv. That leaves you with odds and ends to handle, such as

```auto
The RTC is running 0 hours, 0 mins and 2 secs behind real time.
The flash last updated 1/3/2018 at 2:04
The last .tab file placed 1/3/2018 at 14:01

```

If you need to get data out of those lines use grok. Make sure you anchor your patterns using ^.

```
    if [message] =~ /^#/ {
        drop {}
    } else if [message] =~ /^\s*$/ {
        drop {}
    } else if [message] =~ /^[A-Za-z0-9]+=/ {
        ruby {
            init => '
                @@metadata = {}
            '
            code => '
                msg = event.get("message")
                matches = msg.scan(/^([A-Za-z0-9]+)=(.*)/)
                m = matches[0]
                @@metadata[m[0]] = m[1]
            '
        }
        drop {}
    } else if [message] =~ /,.*,.*,/ {
        csv {
            autodetect_column_names => true
        }
        ruby {
            code => '
                event.set("metadata", @@metadata)
            '
        }
    }
```

---

_[View the full topic](https://discuss.elastic.co/t/parse-log-file-with-two-formats-in-it/166876)._