# Read REST API logs and push them to elasticsearch

**URL:** https://discuss.elastic.co/t/read-rest-api-logs-and-push-them-to-elasticsearch/85638
**Category:** Logstash
**Created:** [May 13, 2017, 11:12am UTC](https://discuss.elastic.co/t/read-rest-api-logs-and-push-them-to-elasticsearch/85638 "2017-05-13T11:12:21Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ayush\_rastogi1](https://avatars.discourse-cdn.com/v4/letter/a/b5e925/32.png) [@ayush\_rastogi1](https://discuss.elastic.co/u/ayush_rastogi1)
#### Post date: [May 13, 2017, 11:12am UTC](https://discuss.elastic.co/t/read-rest-api-logs-and-push-them-to-elasticsearch/85638/1 "2017-05-13T11:12:21Z")

</div>

Hi Guys,

I am trying to process the Service API request logs and trying to data to elasticsearch

A sample line from my logs look like

`
"111.125.230.58 - - [13/May/2017:08:50:35 +0000] \"GET /ContentStorageService/coss-test-bucket/resources HTTP/1.1\" 200 272584 \"-\" \"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36\" 166"
`

I want the following data to go in elaticsearch in in the following format

`
IP -> 111.125.230.58
Request Type -> 'GET /ContentStorageService/coss-test-bucket/resources HTTP/1.1\"
Status -> '200'
TIME -> 272584 
`

I tried many filters but looks like I couldn't fit any of them into my need.

Is there any suggestion / recommendation for this kind of log processing.

Is there any filter made for this specific task.

Thanks,  
Ayush

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 14, 2017, 5:18am UTC](https://discuss.elastic.co/t/read-rest-api-logs-and-push-them-to-elasticsearch/85638/2 "2017-05-14T05:18:41Z")

</div>

That looks like a pretty standard apache log format.  
Have you seen grok?

---

<div class="post-metadata">

### Author: ![ayush\_rastogi1](https://avatars.discourse-cdn.com/v4/letter/a/b5e925/32.png) [@ayush\_rastogi1](https://discuss.elastic.co/u/ayush_rastogi1)
#### Post date: [May 30, 2017, 4:27pm UTC](https://discuss.elastic.co/t/read-rest-api-logs-and-push-them-to-elasticsearch/85638/3 "2017-05-30T16:27:07Z")

</div>

Thanks Mark for the reply, I have a working pattern now

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2017, 4:27pm UTC](https://discuss.elastic.co/t/read-rest-api-logs-and-push-them-to-elasticsearch/85638/4 "2017-06-27T16:27:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.