# Parse springboot logs using logstash
**URL:** https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422
**Category:** Logstash
**Created:** [July 22, 2021, 7:45pm UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422 "2021-07-22T19:45:02Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [July 22, 2021, 7:45pm UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/1 "2021-07-22T19:45:02Z")
Hi Team,
I need to parse below logs using logstash. I used grok but it is giving parsingerror.
Grok-
filter {
grok {
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{JAVACLASS:logclass} %{CUSTOM\_TRACE\_EXCEPTION:exception} %{CUSTOM\_TRACE\_CAUSED\_BY:causedby} %{GREEDYDATA:content}"
}
}
Logs -
2021-07-21 18:31:24 [http-nio-2222-exec-1] DEBUG c.v.a.ultimatevault.web.TraceFilter - Returning status 200 for GET /ultimatevault/api/v1/heartbeat
2021-07-21 18:31:27 [http-nio-2222-exec-2] DEBUG c.v.a.ultimatevault.web.TraceFilter - Processing request: GET /ultimatevault/api/v1/heartbeat
2021-07-21 18:31:27 [http-nio-2222-exec-2] DEBUG c.v.a.ultimatevault.web.TraceFilter - Returning status 200 for GET /ultimatevault/api/v1/heartbeat
2021-07-21 18:31:34 [http-nio-2222-exec-3] DEBUG c.v.a.ultimatevault.web.TraceFilter - Processing request: GET /ultimatevault/api/v1/heartbeat
2021-07-21 18:31:34 [http-nio-2222-exec-3] DEBUG c.v.a.ultimatevault.web.TraceFilter - Returning status 200 for GET /ultimatevault/api/v1/heartbeat
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [July 22, 2021, 7:47pm UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/2 "2021-07-22T19:47:21Z")
Need to urgent reply.
Thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 22, 2021, 7:49pm UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/3 "2021-07-22T19:49:20Z")
> [@Nikparab](#):
>
> [http-nio-2222-exec-1]
Your pattern does not match this part of the log entry.
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [July 22, 2021, 7:53pm UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/4 "2021-07-22T19:53:33Z")
Can I get correct pattern please for above logs?
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [July 22, 2021, 7:59pm UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/5 "2021-07-22T19:59:59Z")
```auto
grok {
match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %
{SKYLOGLEVEL:loglevel} %{THREAD:thread} %{RMOTEIP:remoteipaddress} %
{JAVACLASS:logclass} %{CUSTOM_TRACE_EXCEPTION:exception} %
{CUSTOM_TRACE_CAUSED_BY:causedby} %{GREEDYDATA:details}"
}
```
This also not working. my logstash version is 7.13
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [July 22, 2021, 8:05pm UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/6 "2021-07-22T20:05:49Z")
`%{TIMESTAMP_ISO8601:timestamp} \[%{PROG:process}\] %{LOGLEVEL:loglevel} %{JAVACLASS:logclass} - %{GREEDYDATA:content}`
```auto
{
"process": "http-nio-2222-exec-1",
"loglevel": "DEBUG",
"content": "Returning status 200 for GET /ultimatevault/api/v1/heartbeat",
"timestamp": "2021-07-21 18:31:24",
"logclass": "c.v.a.ultimatevault.web.TraceFilter"
}
```
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [July 23, 2021, 5:16am UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/7 "2021-07-23T05:16:45Z")
Thanks for quick solution
---
### Author:  [@Nikparab](https://discuss.elastic.co/u/Nikparab)
#### Post date: [July 23, 2021, 5:39am UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/8 "2021-07-23T05:39:04Z")
Could you please share the grok filter syntax which you used? I am not getting timestamp which is in log. I am getting current timestamp
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [July 23, 2021, 5:44am UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/9 "2021-07-23T05:44:25Z")
Use This.
> **[Date filter plugin | Logstash Reference \[7.13\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)**
Example
```auto
filter {
date {
match => ["timestamp", "ISO8601"]
}
}
```
You will just need to use the correct format
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2021, 5:45am UTC](https://discuss.elastic.co/t/parse-springboot-logs-using-logstash/279422/10 "2021-08-20T05:45:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.