# Read Particular line from log File

**URL:** <https://discuss.elastic.co/t/read-particular-line-from-log-file/90256>\
**Category:** Logstash\
**Created:** [June 21, 2017, 9:45am UTC](https://discuss.elastic.co/t/read-particular-line-from-log-file/90256 "2017-06-21T09:45:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [June 21, 2017, 9:45am UTC](https://discuss.elastic.co/t/read-particular-line-from-log-file/90256/1 "2017-06-21T09:45:56Z")

</div>

Hi ,

I have to read 3 different lines from log files based on some text and then output the fields in a csv file.

sample log data:-

20110607 095826 [.] !! Begin test. Script filename/text.txt  
20110607 095826 [.] Full path: filename/test/text.txt  
20110607 095828 [.] FAILED: Test Failed()..

i have to read file name after !!Begin test. Script. this is my conf file

input  
{  
beats{

```
port => 5443
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
type => "og"
}

```

}

filter {  
if [type] == "log" {

```
grok

```

{  
match =\> {"message" =\> "%{BASE10NUM:Date}%{SPACE:pat}%{BASE10NUM:Number}%{SPACE:pat}[.]%{SPACE:pat}%{SPACE:pat}!! Begin test. Script%{SPACE:pat}%{GREEDYDATA:file}"}  
overwrite =\> ["message"]  
}

if "\_grokparserfailure" in [tags]  
{  
drop{}  
}  
}  
}

output {

file{  
path =\> "/output/logstash/File12.txt"  
codec =\> "json"  
}

stdout { codec =\> "json" }  
}

but its not giving me single record, its parsing full log file in json format no parsed field  
.

Please advice i think i am missing some basic concept of logstash

Thanks  
Richa

---

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [June 23, 2017, 9:27am UTC](https://discuss.elastic.co/t/read-particular-line-from-log-file/90256/2 "2017-06-23T09:27:04Z")

</div>

Hi,

Issue has resolved , grok does not read %{SPACE} pattern.

new grok pattern.

{"message" =\> "%{BASE10NUM:Date} %{BASE10NUM:Number} !! Begin test. Script%  
{GREEDYDATA:file}"}

now i am getting the exact output

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2017, 9:27am UTC](https://discuss.elastic.co/t/read-particular-line-from-log-file/90256/3 "2017-07-21T09:27:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.