# Problem with coding Grok filter

**URL:** https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484
**Category:** Logstash
**Created:** [June 6, 2017, 10:42pm UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484 "2017-06-06T22:42:07Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)
#### Post date: [June 6, 2017, 10:42pm UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484/1 "2017-06-06T22:42:08Z")

</div>

Hi there, I have this message  
`2017-05-01 08:09:19 [scraper.py] ERROR: Error downloading <POST http://localhost:8050/render.html>`

I want to write a grok filter to extract this part `Error downloading <POST http://localhost:8050/render.html>`

I coded this`'ERROR': %{GREEDYDATA:error_msg}` but it doesn't match, can you help?

---

<div class="post-metadata">

### Author: ![ugosan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ugosan/32/18916_2.png) [@ugosan](https://discuss.elastic.co/u/ugosan)
#### Post date: [June 6, 2017, 11:09pm UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484/2 "2017-06-06T23:09:22Z")

</div>

@ibrahimsharaf It would be something like this:  
`%{TIMESTAMP_ISO8601}%{SPACE}%{NOTSPACE}%{SPACE}%{LOGLEVEL}%{NOTSPACE}%{SPACE}%{GREEDYDATA:error_msg}`

---

<div class="post-metadata">

### Author: ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)
#### Post date: [June 7, 2017, 10:01am UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484/3 "2017-06-07T10:01:02Z")

</div>

@ugosan How can I get only the ERROR messages? I don't want to get other loglevel messages such as DEBUG and INFO.

---

<div class="post-metadata">

### Author: ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [June 7, 2017, 11:33am UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484/4 "2017-06-07T11:33:13Z")

</div>

You can use:

```auto
%{TIMESTAMP_ISO8601} %{NOTSPACE} ERROR: %{GREEDYDATA:error_msg}

```

and then inside grok filter, add the loglevel field, or either:

```auto
%{TIMESTAMP_ISO8601} %{NOTSPACE} (?<Loglevel>ERROR): %{GREEDYDATA:error_msg}

```

The synthax with (? ) defines a field with \< name \> that match the regex pattern that follows. And a plain string is a also a regex.

With any of these pattern, you will only get messages with loglevel ERROR (case sensitive).

---

<div class="post-metadata">

### Author: ![ugosan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ugosan/32/18916_2.png) [@ugosan](https://discuss.elastic.co/u/ugosan)
#### Post date: [June 7, 2017, 1:12pm UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484/5 "2017-06-07T13:12:54Z")

</div>

@ibrahimsharaf Well if you tag your LOGLEVEL with a variable name, say loglevel like:  
`%{TIMESTAMP_ISO8601}%{SPACE}%{NOTSPACE}%{SPACE}%{LOGLEVEL:loglevel}%{NOTSPACE}%{SPACE}%{GREEDYDATA:error_msg}`

...then you might filter it out before sending it to elasticsearch like:

```
output {
      if [loglevel] == 'ERROR' {
             elasticsearch { 
                     ... 
             }
      }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 1:13pm UTC](https://discuss.elastic.co/t/problem-with-coding-grok-filter/88484/6 "2017-07-05T13:13:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.