# Parsing IBM Integration Bus logs with Grok

**URL:** <https://discuss.elastic.co/t/parsing-ibm-integration-bus-logs-with-grok/126336>\
**Category:** Logstash\
**Created:** [March 31, 2018, 7:31pm UTC](https://discuss.elastic.co/t/parsing-ibm-integration-bus-logs-with-grok/126336 "2018-03-31T19:31:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mladen](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@mladen](https://discuss.elastic.co/u/mladen)\
**Post date:** [March 31, 2018, 7:31pm UTC](https://discuss.elastic.co/t/parsing-ibm-integration-bus-logs-with-grok/126336/1 "2018-03-31T19:31:21Z")

</div>

Hello,

searching the internet I didn't find the right grok filter for IBM integration bus logs. At the end I decided to try by may self. Filter is working but I have opinion that it can be better. Below you can find my grok filter with log.

`Mar 28 12:12:01 localhost IIB[5979]: IBM Integration Bus v10008 (INDEV2.default) [Thread 21750] (Msg 1/1) BIP2153I: About to 'Start' an integration server.`

`%{SYSLOGTIMESTAMP} %{HOSTNAME} %{WORD:SYSTEM}\[%{BASE10NUM:PID}]: %{WORD:DONTNEED1} %{WORD:DONTNEED2} %{WORD:DONTNEED3} %{WORD:DONTNEED4} \(%{WORD:NODE}.%{WORD:EG}\) \[%{WORD:DONTNEED5} %{BASE10NUM:DONTNEED6}] \(%{WORD:DONTNEED7} %{NOTSPACE}\) %{WORD:CODE}: %{GREEDYDATA:MESSAGE}`

My questions are as follows:

Could you please give me some hints to improve my filter?  
Is it possible for example to take three words with spaces end put in one field? For example:  
`IBM Integration Bus`  
I have some words that is not useful for me. Can I skip them?

I am new in this so don't be harsh on me 😊.

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 31, 2018, 8:05pm UTC](https://discuss.elastic.co/t/parsing-ibm-integration-bus-logs-with-grok/126336/2 "2018-03-31T20:05:36Z")

</div>

> [@mladen](#):
>
> `%{WORD:DONTNEED1}`

If you don't need it, don't capture it to a variable 😉

```auto
%{WORD}

```

> [@mladen](#):
>
> Is it possible for example to take three words with spaces end put in one field? For example:
> 
> ```auto
> IBM Integration Bus
> 
> ```
> 
> I have some words that is not useful for me.

Is is always "three words with spaces", or is it always literally `IBM Integration Bus`?

If it is the latter, it is easier and more efficient to just include the literal bit in your Grok pattern:

```auto
%{SYSLOGTIMESTAMP} %{HOSTNAME} %{WORD:SYSTEM}\[%{BASE10NUM:PID}]: IBM Integration Bus %{WORD} \(%{WORD:NODE}.%{WORD:EG}\) \[%{WORD} %{BASE10NUM}] \(%{WORD} %{NOTSPACE}\) %{WORD:CODE}: %{GREEDYDATA:MESSAGE}
```

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 31, 2018, 8:09pm UTC](https://discuss.elastic.co/t/parsing-ibm-integration-bus-logs-with-grok/126336/3 "2018-03-31T20:09:01Z")

</div>

And, you probably will want to add the beginning-of-line anchor `^` to the very beginning of your pattern if we _know_ that there isn't going to be random junk before the timestamp.

Without it, when the pattern matcher fails, it will start over from the second letter, fail again, start over with the third letter, fail again, and so-on, making the failure to match pretty computationally expensive.

---

<div class="post-metadata">

**Author:** ![mladen](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@mladen](https://discuss.elastic.co/u/mladen)\
**Post date:** [March 31, 2018, 9:28pm UTC](https://discuss.elastic.co/t/parsing-ibm-integration-bus-logs-with-grok/126336/4 "2018-03-31T21:28:03Z")

</div>

> [@yaauie](#):
>
> IBM Integration Bus

Always is _IBM Integration Bus_ so I can use it 🙂. Thank you very much for your answers, it help me a lot. Also I learn something new 🙂

BR,  
Mladen

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2018, 9:28pm UTC](https://discuss.elastic.co/t/parsing-ibm-integration-bus-logs-with-grok/126336/5 "2018-04-28T21:28:05Z")

</div>

Closed on April 28, 2018, 9:28pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.