# Parse specific file text

**URL:** <https://discuss.elastic.co/t/parse-specific-file-text/72780>\
**Category:** Logstash\
**Created:** [January 25, 2017, 1:49pm UTC](https://discuss.elastic.co/t/parse-specific-file-text/72780 "2017-01-25T13:49:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [January 25, 2017, 1:49pm UTC](https://discuss.elastic.co/t/parse-specific-file-text/72780/1 "2017-01-25T13:49:18Z")

</div>

Hello,

I have some lines in a file text and i want parse it with logstash to create graph.

I'm begginers to use logstash.

Here few examples of file text, each hour new lines are copied in:

```
20170123215959;Volume_data_hour-C-FWK-BMA-EDR-2-Zone-Volume;Appli1;376622
20170123215959;Volume_data_hour-C-FWK-BMA-EDR-2-Zone-Volume;Appli2;464431  
20170123215959;Volume_data_hour-C-FWK-BMA-EDR-2-Zone-Volume;Appli3;79
20170123215959;Volume_data_hour-C-FWK-BMA-EDR-2-Zone-Volume;Appli4;60

20170123215959;Volume_data_heure-C-FWK-BMA-EDR-1-VolumeTot;900450

```

At the end, i want Five Graphs (4 applis + one total) alimented each hour.

It's possible ? If yes whats ?

PS : I have a file conf in /etc/logstash/conf.d/syslog.conf (it's retrieves syslog message). I must create a new conf file named for example volume\_hour.conf ? or write in the conf file existant ?

---

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [January 25, 2017, 3:54pm UTC](https://discuss.elastic.co/t/parse-specific-file-text/72780/2 "2017-01-25T15:54:21Z")

</div>

I try this to cut my line correctly :

%{DATE:date};%{WORD:compteur};%{WORD:Appli};%{INT:Volume}

---

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [January 26, 2017, 10:00am UTC](https://discuss.elastic.co/t/parse-specific-file-text/72780/3 "2017-01-26T10:00:31Z")

</div>

I have found this syntax to cut correctly my line :

20170123215959;Volume\_data\_hour-C-FWK-BMA-EDR-2-Zone-Volume;Appli1;88582

```
%{DATA:date}[;]%{DATA:nom_compteur}[;]%{DATA:zone}[;]%{INT:volume}

```

{  
"date": [  
"20170123215959"  
],  
"nom\_compteur": [  
"Volume\_data\_hour-C-FWK-BMA-EDR-2-Zone-Volume"  
],  
"zone": [  
"Europe"  
],  
"volume": [  
"88582"  
]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2017, 10:00am UTC](https://discuss.elastic.co/t/parse-specific-file-text/72780/4 "2017-02-23T10:00:42Z")

</div>

Closed on February 23, 2017, 10:00am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.