Personal Fields in Grok Debugger

Hi All,

I'm early on ELK. I have an log for one application in my Apache and i need to get values of this this Fields


In Kibana, i have this information in field message:

INFO [20 jul 2018 09:25:21] PoolJDBC - [Pool Properties] NumConnections: 50 | NumBusyConnections: 2 | NumIdleConnections: 48

How i can get this information on Grok Debbuger?


How are you sending logs to ElasticSearch ?


in this case, i'm use filebeat 6.3.1

I more likely asked whether you use Logstash or straight to ES. You can parse message in logstash in which you extract fields you want.

For this case, i have a filebeat in my application server (Windows 2012) with this configurations on filebeat.yml


During this weekend i tried to read this information using a Grok Debugger online (

Below are my best result :

%{WORD:T1} %{WORD:T2} %{WORD:T3} %{TIME:H1}\S %{WORD:T4}\s\S\s\S%{WORD:T5}\s%{WORD:T6}\S %{WORD:NunnConn}\S\s%{NUMBER:NumConnections}\s\S\s%{WORD:NumBusy}\S\s%{NUMBER:NumBusyConnections}\s\S\s%{WORD:NumIdle}\S\s%{NUMBER:NumIdleConnections}

message: INFO [19 jul 2018 22:23:48] PoolJDBC - [Pool Properties] NumConnections: 50 | NumBusyConnections: 1 | NumIdleConnections: 49

I see this result in my Kibana (with default configuration):

Thank you for your support.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.