# Read logs stored using Enterprise Semantic Logging format

**URL:** https://discuss.elastic.co/t/read-logs-stored-using-enterprise-semantic-logging-format/46449
**Category:** Logstash
**Created:** [April 5, 2016, 8:20pm UTC](https://discuss.elastic.co/t/read-logs-stored-using-enterprise-semantic-logging-format/46449 "2016-04-05T20:20:47Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)
#### Post date: [April 5, 2016, 10:35pm UTC](https://discuss.elastic.co/t/read-logs-stored-using-enterprise-semantic-logging-format/46449/3 "2016-04-05T22:35:21Z")

</div>

I tried it. Even had posted this on the forum, but NO reply ☹

> [@Optimizing my current GROK Filter](https://discuss.elastic.co/t/optimizing-my-current-grok-filter/45289):
>
> I am new to GROK work. As of now, I have created a filter which extracts all the data. But I need to extract only the SessionID, Method, RequestURI and Content values only. This is my request log EventId : 1, Level : Informational, Message : Request, Payload : [sessionID : 43a7be8b-3222-4958-9082-ecc4428f0037] [ipAddress : 172.16.22.88] [method : POST] [requestUri : [https://myserver.my](https://myserver.my),com:4433/MyService/api/click2mob] [content : {"callType":"Sales\_Appl","customer":{"firstName":"Service","las…

This is my request log

EventId : 1, Level : Informational, Message : Request, Payload : [**sessionID** : 43a7be8b-3222-4958-9082-ecc4428f0037] [ipAddress : 172.16.22.88] [method : **POST**] [requestUri : **[https://myserver.my](https://myserver.my),com:4433/MyService/api/click2mob**] [content : {"callType":"Sales\_Appl","customer":{"firstName":"Service","lastName":"Interceptor","phones":[{"countryCode":"1","areaCode":"612","number":"2221213"}],"emailAddresses":[{"[email":"myinterceptor@bestbuy.com](mailto:email%22:%22myinterceptor@bestbuy.com)"}]}}] , EventName : RequestInfo, Timestamp : 2016-03-22T04:06:01.4157082Z, ProcessId : 9784, ThreadId : 18768

My Current GROK Filter in Logstash -

%{WORD:Event} %{NOTSPACE:Colons} %{WORD:EventID}%{NOTSPACE:Colons} %{WORD:Level} %{NOTSPACE:Colons} %{WORD:LevelDetail}%{NOTSPACE:Colons} %{WORD:Message} %{NOTSPACE:Colons} %{WORD:Request}%{NOTSPACE:Colons} %{WORD:Payload} %{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: Session} %{NOTSPACE:Colons} %{UUID:SessionID}%{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: IPAddress} %{NOTSPACE:Colons} %{IPORHOST:IP}%{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: Method} %{NOTSPACE:Colons} %{WORD:HTTP\_VERB}%{NOTSPACE:Colons} %{NOTSPACE:Colons}%{WORD: RequestURI} %{NOTSPACE:Colons} %{URI:URL}%{NOTSPACE:Colons}%{WORD: content} %{NOTSPACE:Colons} %{GREEDYDATA:keyvalues}%{NOTSPACE:Colons} %{WORD: EventName} %{NOTSPACE:Colons} %{WORD:RequestInfo}%{NOTSPACE:Colons} %{WORD:IIS\_TimeStamp} %{NOTSPACE:Colons} %{TIMESTAMP\_ISO8601:IIS\_TimeStamp}%{NOTSPACE:Colons} %{WORD: ProcessID} %{NOTSPACE:Colons} %{WORD:Process\_ID}%{NOTSPACE:Colons} %{WORD: ThreadID} %{NOTSPACE:Colons} %{WORD:Thread\_ID}

How can I optimize this query to get only the req. values?

Is there anything that can help me here ?

---

_[View the full topic](https://discuss.elastic.co/t/read-logs-stored-using-enterprise-semantic-logging-format/46449)._