# PARSE Logs having pip saperator
**URL:** https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881
**Category:** Logstash
**Created:** [October 16, 2021, 2:54am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881 "2021-10-16T02:54:15Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [October 16, 2021, 2:54am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/1 "2021-10-16T02:54:15Z")
Hi I am having the log format as below.
2021-10-16 00:14:14|http-nio-2222-exec-1|DEBUG|c.v.a.ultimatevault.web.TraceFilter|01AD08F98FB24AB7A639383F44613AE4|Processing request:- id: 01AD08F98FB24AB7A639383F44613AE4 method: GET path: /|
2021-10-16 00:14:14|http-nio-2222-exec-1|DEBUG|c.v.a.ultimatevault.web.TraceFilter|01AD08F98FB24AB7A639383F44613AE4|Returning status:- id: 01AD08F98FB24AB7A639383F44613AE4 method: GET path: /|
2021-10-16 00:14:15|http-nio-2222-exec-9|DEBUG|c.v.a.ultimatevault.web.TraceFilter|8235965B298343CF80198C7E443A86DF|Processing request:- id: 8235965B298343CF80198C7E443A86DF method: GET path: /|
how to parse this using logstash. Need immediate responce
I am having below filter
filter {
grok {
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp}|([%{DATA:thread}])?|%{LOGLEVEL:level}%|%{JAVACLASS:class}.|%{DATA:method}|%{GREEDYDATA:loggedString}"
}
}
but its not working.
Thanks
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [October 16, 2021, 3:02am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/2 "2021-10-16T03:02:36Z")
Need help on immediate basis
How can we parse this?
Pls assist
Thanks in advance
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [October 16, 2021, 3:15am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/3 "2021-10-16T03:15:19Z")
> [@Nikparab](#):
>
> Need immediate responce
Please be patient in waiting for responses to your question and refrain from pinging multiple times asking for a response or opening multiple topics for the same question. This is a community forum, it may take time for someone to reply to your question. For more information please refer to the [Community Code of Conduct](https://www.elastic.co/community/codeofconduct) specifically the section "Be patient". Also, please refrain from pinging folks directly, this is a forum and anyone that participates might be able to assist you.
If you are in need of a service with an SLA that covers response times for questions then you may want to consider talking to us about a [subscription](https://www.elastic.co/subscriptions).
It's fine to answer on your own thread after 2 or 3 days (not including weekends) if you don't have an answer.
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [October 16, 2021, 3:17am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/4 "2021-10-16T03:17:46Z")
Yes Got it. Thanks @dadoonet
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [October 16, 2021, 3:26am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/5 "2021-10-16T03:26:20Z")
@stephenb last time we have processed same logs but now having pipe separator in it.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 16, 2021, 3:29am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/6 "2021-10-16T03:29:39Z")
I would recommend using the [dissect filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) instead as it is generally faster for this type of pattern and often easier to configure and troubleshoot.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 16, 2021, 3:31am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/7 "2021-10-16T03:31:39Z")
I would suggest using a dissect filter to take apart the | separated fields, then use a set of grok filters to chop up things like
```
Returning status:- id: 01AD08F98FB24AB7A639383F44613AE4 method: GET path: /
```
since that looks a lot like
```
Processing request:- id: 8235965B298343CF80198C7E443A86DF method: GET path: /
```
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [October 16, 2021, 3:33am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/8 "2021-10-16T03:33:50Z")
grok {
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} ([%{DATA:thread}])? %{LOGLEVEL:level}%{SPACE}%{JAVACLASS:class}.%{DATA:method} - %{GREEDYDATA:loggedString}"
}
This was working fine before. when pipe saperator comes in log file then its failing. Can some one please correct me in above filter?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 13, 2021, 3:34am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881/9 "2021-11-13T03:34:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.