# Remain json data as field in Logstash

**URL:** <https://discuss.elastic.co/t/remain-json-data-as-field-in-logstash/31784>\
**Category:** Logstash\
**Created:** [October 7, 2015, 3:31pm UTC](https://discuss.elastic.co/t/remain-json-data-as-field-in-logstash/31784 "2015-10-07T15:31:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ducheol\_Kim](https://avatars.discourse-cdn.com/v4/letter/d/8edcca/32.png) [@Ducheol\_Kim](https://discuss.elastic.co/u/Ducheol_Kim)\
**Post date:** [October 7, 2015, 3:31pm UTC](https://discuss.elastic.co/t/remain-json-data-as-field-in-logstash/31784/1 "2015-10-07T15:31:15Z")

</div>

Hi Guys.

Currently, I'm building component which log json data in ES.  
So I'm trying to use below grok filter pattern to parse , but it isn't work.

Input  
Tue, 06 Oct 2015 20:04:15 +0000 - [http://localhost/testurl?id=127](http://localhost/testurl?id=127) - {"request":{"TEST":"1234"}} - 200-{"response":{"status":"OK","count"}

grok config  
grok{  
patterns\_dir =\> "./patterns"  
match =\> {  
"message" =\> "%{DATESTAMP\_RFC2822:time} - %{URI:uri} - {DATA:request} - {POSINT:code}- {DATA:response}"  
}  
}

What is wrong ? It is about json or about others ?

---

<div class="post-metadata">

**Author:** ![l1carter](https://avatars.discourse-cdn.com/v4/letter/l/74df32/32.png) [@l1carter](https://discuss.elastic.co/u/l1carter)\
**Post date:** [October 7, 2015, 4:53pm UTC](https://discuss.elastic.co/t/remain-json-data-as-field-in-logstash/31784/2 "2015-10-07T16:53:41Z")

</div>

new here so could be way off but looks like your pattern "DATESTAMP\_RFC2822" doesn't match your log timestamp format... in the patterns file it says:

DATESTAMP\_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}

your log format looks to be (DAY, MONTHDAY, MONTH, YEAR, TIME, TZ...)

you could try this tool to build the grok statement... been helpful for me on what little I've done.

[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

---

<div class="post-metadata">

**Author:** ![Ducheol\_Kim](https://avatars.discourse-cdn.com/v4/letter/d/8edcca/32.png) [@Ducheol\_Kim](https://discuss.elastic.co/u/Ducheol_Kim)\
**Post date:** [October 7, 2015, 5:40pm UTC](https://discuss.elastic.co/t/remain-json-data-as-field-in-logstash/31784/3 "2015-10-07T17:40:44Z")

</div>

Thanks Lee.

But, according to below page, DATESTAMP\_RFC2822 is like below.

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns>

DATESTAMP\_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601\_TIMEZONE}  
Tue, 06 Oct 2015 20:04:15 +0000

Looks like DATESTAMP\_RFC2822 is same with my date format. isn't it ?

Regards  
Ducheol

---

<div class="post-metadata">

**Author:** ![Ducheol\_Kim](https://avatars.discourse-cdn.com/v4/letter/d/8edcca/32.png) [@Ducheol\_Kim](https://discuss.elastic.co/u/Ducheol_Kim)\
**Post date:** [October 7, 2015, 7:44pm UTC](https://discuss.elastic.co/t/remain-json-data-as-field-in-logstash/31784/4 "2015-10-07T19:44:09Z")

</div>

Sorry. It is my mistake.

I didn't put % before the pattern. It work fine after put the %

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/remain-json-data-as-field-in-logstash/31784/5 "2017-07-06T05:27:11Z")

</div>