# Parsing log using grok format

**URL:** <https://discuss.elastic.co/t/parsing-log-using-grok-format/35779>\
**Category:** Logstash\
**Created:** [November 27, 2015, 4:27pm UTC](https://discuss.elastic.co/t/parsing-log-using-grok-format/35779 "2015-11-27T16:27:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![openRepo](https://avatars.discourse-cdn.com/v4/letter/o/c67d28/32.png) [@openRepo](https://discuss.elastic.co/u/openRepo)\
**Post date:** [November 27, 2015, 4:27pm UTC](https://discuss.elastic.co/t/parsing-log-using-grok-format/35779/1 "2015-11-27T16:27:43Z")

</div>

Hello,

I am new to logstash and trying to parse below log using grok format.

2015-11-27 11:51:28,103 INFO org.xyz.abc.ClassName @ anonymous:session\_id=20B27B5F10A828221F1C3D8B578267E9:ip\_addr=xx.xxx.xx.xxx:view\_collection:collection\_id=xxxxx

So far i have build first three field using  
%{TIMESTAMP\_ISO8601:timestamp}\s+%{LOGLEVEL:loglevel}\s+(?(?:[a-zA-Z0-9-]+.)\*[A-Za-z0-9$]+)\s

which gives me

timestamp 2015-11-27·11:51:28,103  
loglevel INFO  
logger org.xyz.abc.ClassName

however, i want to parse other field like

user anonymous  
session 20B27B5F10A828221F1C3D8B578267E9  
ip xx.xxx.xx.xxx  
action view\_collection  
collectionId xxxxx

i tried several regular expression command at [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match) to achieve above but none working with grok.

Any help greatly appreciated

Thanks

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 27, 2015, 5:22pm UTC](https://discuss.elastic.co/t/parsing-log-using-grok-format/35779/2 "2015-11-27T17:22:32Z")

</div>

The content after the '@' sign seems to be a property list. Catch all this into a single variable using grok and then use the [KV filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) to parse this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/parsing-log-using-grok-format/35779/3 "2017-07-06T05:20:58Z")

</div>