# Parsing specific values from logs in logstash configuration
**URL:** https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288
**Category:** Logstash
**Created:** [February 16, 2017, 6:32am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288 "2017-02-16T06:32:22Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)
#### Post date: [February 16, 2017, 6:32am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/1 "2017-02-16T06:32:22Z")
Hi,
I am currently using default logstash configuration to parse the apache server access log file and index it to elasticsearch.
However, I don't want to parse all fields in log but say specific ones like IP, Referrer, status code, etc.
How can I selectively specify in configuration of logstash to parse only those fields.
My current configuration is as follows:
> input {
> beats {
> port =\> 5044
> }
> }
> filter {
> grok {
> match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}
> }
> }
> output {
> elasticsearch {
> hosts =\> "localhost:9200"
> #manage\_template =\> false
> #index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
> #document\_type =\> "%{[@metadata][type]}"
> }
>
> stdout { codec =\> rubydebug }
> }
Can someone throw light on it?
Thanks.
Saurabh
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 16, 2017, 6:34am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/2 "2017-02-16T06:34:33Z")
You need to parse them all, then use `remove_field` to drop things.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2017, 6:53am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/3 "2017-02-16T06:53:00Z")
Instead of using `remove_field` you can use the prune filter to delete all fields _except_ those you want to keep.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 16, 2017, 6:56am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/4 "2017-02-16T06:56:01Z")
Even better!
---
### Author:  [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)
#### Post date: [February 16, 2017, 7:06am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/5 "2017-02-16T07:06:25Z")
Can you please give example pf prune filter on how to selectively chose the fields?
Thanks in advance.
Saurabh
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 16, 2017, 7:08am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/6 "2017-02-16T07:08:29Z")
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html) has one.
---
### Author:  [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)
#### Post date: [February 16, 2017, 7:11am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/7 "2017-02-16T07:11:29Z")
Thanks. Is there a documentation where I can see how each field in log is mapped? For instance; date may be referred as "datetimestamp" in logstash configuration.
I want to add performance logging in apache in httpd.conf file where i can print time taken by request on application server. How will i parse that value from log. So i want to understand how the fields are mapped and referred in filters.
Sorry for basic questions but i am newbie to this world.
Thanks a lot for your help.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 16, 2017, 7:12am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/8 "2017-02-16T07:12:49Z")
That's [https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html).
You can see what each of the patterns means here - [https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns](https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns)
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2017, 7:28am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/9 "2017-02-16T07:28:14Z")
> I want to add performance logging in apache in httpd.conf file where i can print time taken by request on application server. How will i parse that value from log.
Apache doesn't log this by default so the "how to parse" question depends on how you make Apache log that information in the first place.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2017, 7:28am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288/10 "2017-03-16T07:28:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.