# Personal Fields in Grok Debugger

**URL:** <https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908>\
**Category:** Kibana\
**Created:** [July 20, 2018, 2:20pm UTC](https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908 "2018-07-20T14:20:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Santos](https://avatars.discourse-cdn.com/v4/letter/e/9de053/32.png) [@Eric\_Santos](https://discuss.elastic.co/u/Eric_Santos)\
**Post date:** [July 20, 2018, 2:20pm UTC](https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908/1 "2018-07-20T14:20:41Z")

</div>

Hi All,

I'm early on ELK. I have an log for one application in my Apache and i need to get values of this this Fields

DataTime:  
NumConnections:  
NumBusyConnections:  
NunIdleConnections:

In Kibana, i have this information in field message:

INFO [20 jul 2018 09:25:21] PoolJDBC - [Pool Properties] NumConnections: 50 | NumBusyConnections: 2 | NumIdleConnections: 48

How i can get this information on Grok Debbuger?

Thanks  
Eric

---

<div class="post-metadata">

**Author:** ![kskubala](https://avatars.discourse-cdn.com/v4/letter/k/c5a1d2/32.png) [@kskubala](https://discuss.elastic.co/u/kskubala)\
**Post date:** [July 20, 2018, 2:35pm UTC](https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908/2 "2018-07-20T14:35:12Z")

</div>

How are you sending logs to ElasticSearch ?

---

<div class="post-metadata">

**Author:** ![Eric\_Santos](https://avatars.discourse-cdn.com/v4/letter/e/9de053/32.png) [@Eric\_Santos](https://discuss.elastic.co/u/Eric_Santos)\
**Post date:** [July 20, 2018, 2:43pm UTC](https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908/3 "2018-07-20T14:43:12Z")

</div>

Hi

in this case, i'm use filebeat 6.3.1

---

<div class="post-metadata">

**Author:** ![kskubala](https://avatars.discourse-cdn.com/v4/letter/k/c5a1d2/32.png) [@kskubala](https://discuss.elastic.co/u/kskubala)\
**Post date:** [July 23, 2018, 8:11am UTC](https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908/4 "2018-07-23T08:11:51Z")

</div>

I more likely asked whether you use Logstash or straight to ES. You can parse message in logstash in which you extract fields you want.

---

<div class="post-metadata">

**Author:** ![Eric\_Santos](https://avatars.discourse-cdn.com/v4/letter/e/9de053/32.png) [@Eric\_Santos](https://discuss.elastic.co/u/Eric_Santos)\
**Post date:** [July 23, 2018, 11:53am UTC](https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908/5 "2018-07-23T11:53:38Z")

</div>

For this case, i have a filebeat in my application server (Windows 2012) with this configurations on filebeat.yml

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/1/3135f50aaf7d0a25032578daa04ff8e070b5c2b1.png)

During this weekend i tried to read this information using a Grok Debugger online ([https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)).

Below are my best result :

%{WORD:T1} %{WORD:T2} %{WORD:T3} %{TIME:H1}\S %{WORD:T4}\s\S\s\S%{WORD:T5}\s%{WORD:T6}\S %{WORD:NunnConn}\S\s%{NUMBER:NumConnections}\s\S\s%{WORD:NumBusy}\S\s%{NUMBER:NumBusyConnections}\s\S\s%{WORD:NumIdle}\S\s%{NUMBER:NumIdleConnections}

message: INFO [19 jul 2018 22:23:48] PoolJDBC - [Pool Properties] NumConnections: 50 | NumBusyConnections: 1 | NumIdleConnections: 49

I see this result in my Kibana (with default configuration):

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/71f88ed364bafbdcbe9445041f71e8e2a4561298.png)

Thank you for your support.

Eric

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2018, 11:53am UTC](https://discuss.elastic.co/t/personal-fields-in-grok-debugger/140908/6 "2018-08-20T11:53:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.