# Parse logs generated by Ksh script

**URL:** <https://discuss.elastic.co/t/parse-logs-generated-by-ksh-script/213166>\
**Category:** Logstash\
**Created:** [December 27, 2019, 9:11am UTC](https://discuss.elastic.co/t/parse-logs-generated-by-ksh-script/213166 "2019-12-27T09:11:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![simo123](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@simo123](https://discuss.elastic.co/u/simo123)\
**Post date:** [December 27, 2019, 9:11am UTC](https://discuss.elastic.co/t/parse-logs-generated-by-ksh-script/213166/1 "2019-12-27T09:11:46Z")

</div>

Hello everyone,  
I'm just beginning with ELK . I have a custom logs generated by Ksh Script (see Below) and I want is possible to exctact specific lines from it like (Comment,Start Date,End Date )  
Perhaps should I use Grok Filter but I dont know how to process with it .

Thanks in davance

* * *

## Program : Script\_Test Start Date : 23/06/2019\_05:10:37

Liste des fichiers a la fin  
-rw-r--r-- 1 svdr users 12335014 Jun 23 05:10 /appli/svdr/P/data/ACGA/Base\_PRODUITS.CSV  
-rw-r--r-- 1 svdr users 33661501 Jun 23 05:10 /appli/svdr/P/data/ACGA/KE24\_Livraison.CSV  
-rw-r--r-- 1 svdr users 62503 Jun 23 05:10 /appli/svdr/P/data/ACGA/ZC75.CSV  
-rw-r--r-- 1 svdr users 17327587 Jun 23 05:10 /appli/svdr/P/data/ACGA/ZM36\_products.CSV  
Les fichiers extraits ANALYTICS CG AFRIQUE ont ete archivees, compresse et deplacees vers =\> /appli/svdr/P/transfert/Emis/ACGA\_20190623-051037.tar.gz

## Fin d'execution du script.

## Program : ACGA\_Extract Comment : FIN\_OK Start Date : 23/06/2019\_05:10:37 End Date : 23/06/2019\_05:10:47 Return Code : 0

---

<div class="post-metadata">

**Author:** ![KashinathPatil](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@KashinathPatil](https://discuss.elastic.co/u/KashinathPatil)\
**Post date:** [December 27, 2019, 11:50am UTC](https://discuss.elastic.co/t/parse-logs-generated-by-ksh-script/213166/2 "2019-12-27T11:50:20Z")

</div>

> [@simo123](#):
>
> er but I dont know how to process with it

you can refer the url :[http://grokdebug.herokuapp.com/patterns#](http://grokdebug.herokuapp.com/patterns#)

also to start with grok I would suggest to go with existing grok filter example

> **[Grok filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)**

additionally you can write your own custom filter logic using various pattern options

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 24, 2020, 11:50am UTC](https://discuss.elastic.co/t/parse-logs-generated-by-ksh-script/213166/3 "2020-01-24T11:50:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.