# Parsing Log4j

**URL:** <https://discuss.elastic.co/t/parsing-log4j/120779>\
**Category:** Logstash\
**Created:** [February 21, 2018, 8:04am UTC](https://discuss.elastic.co/t/parsing-log4j/120779 "2018-02-21T08:04:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eswar\_Kumar\_Musiboin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eswar_kumar_musiboin/32/28623_2.png) [@Eswar\_Kumar\_Musiboin](https://discuss.elastic.co/u/Eswar_Kumar_Musiboin)\
**Post date:** [February 21, 2018, 8:04am UTC](https://discuss.elastic.co/t/parsing-log4j/120779/1 "2018-02-21T08:04:16Z")

</div>

To parse log4j logs in the logstash .i need a standard configuration file using different filter plugins. if anybody have the file please help me out

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 21, 2018, 9:21am UTC](https://discuss.elastic.co/t/parsing-log4j/120779/2 "2018-02-21T09:21:32Z")

</div>

Log files written by Log4j come in a thousand shapes and colors so there is no standard configuration file for processing them.

---

<div class="post-metadata">

**Author:** ![Eswar\_Kumar\_Musiboin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eswar_kumar_musiboin/32/28623_2.png) [@Eswar\_Kumar\_Musiboin](https://discuss.elastic.co/u/Eswar_Kumar_Musiboin)\
**Post date:** [February 21, 2018, 9:26am UTC](https://discuss.elastic.co/t/parsing-log4j/120779/3 "2018-02-21T09:26:18Z")

</div>

can you please send me the different sample logs

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 21, 2018, 10:13am UTC](https://discuss.elastic.co/t/parsing-log4j/120779/4 "2018-02-21T10:13:47Z")

</div>

???

You're probably going to want a grok filter for parsing your logs. Unless you're familiar with regular expressions I suggest you use the grok constructor web site to get help building your grok expression.

Depending on what your logs look like and how you want to parse them the dissect filter might do. It's probably easier to understand but it's less flexible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 10:13am UTC](https://discuss.elastic.co/t/parsing-log4j/120779/5 "2018-03-21T10:13:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.