# Required Logstash grok pattern to read tableau server log **URL:** \ **Category:** Logstash\ **Created:** [July 9, 2018, 12:05pm UTC](https://discuss.elastic.co/t/required-logstash-grok-pattern-to-read-tableau-server-log/139162 "2018-07-09T12:05:42Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![swatititame](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@swatititame](https://discuss.elastic.co/u/swatititame)\ **Post date:** [July 9, 2018, 12:05pm UTC](https://discuss.elastic.co/t/required-logstash-grok-pattern-to-read-tableau-server-log/139162/1 "2018-07-09T12:05:43Z")
Hi, Sample Log Data > com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\TBX-Dept-Quality-SU has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] > 2018-06-11 17:00:50.242 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.service.BackgroundJobService - Queued job: id[4727304], type[SyncActiveDirectoryGroup], site[Subscriptionsite], args[[TBX-ADMIN, [corp.intusurg.com](http://corp.intusurg.com), SITE\_ADMIN]] > 2018-06-11 17:00:50.246 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\TBX-ADMIN has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] > 2018-06-11 17:00:50.249 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.service.BackgroundJobService - Queued job: id[4727305], type[SyncActiveDirectoryGroup], site[Subscriptionsite], args[[All\_VPs\_globally, [corp.intusurg.com](http://corp.intusurg.com), VIEWER]] > 2018-06-11 17:00:50.251 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\All\_VPs\_globally has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] > 2018-06-11 17:00:50.253 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.service.BackgroundJobService - Queued job: id[4727306], type[SyncActiveDirectoryGroup], site[Subscriptionsite], args[[TBX-Dept-Quality-EU, [corp.intusurg.com](http://corp.intusurg.com), INTERACTOR]] > 2018-06-11 17:00:50.256 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\TBX-Dept-Quality-EU has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] > 2018-06-11 17:00:50.259 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.service.BackgroundJobService - Queued job: id[4727307], type[SyncActiveDirectoryGroup], site[Subscriptionsite], args[[BI DevOps Team, [corp.intusurg.com](http://corp.intusurg.com), INTERACTOR]] > 2018-06-11 17:00:50.261 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\BI DevOps Team has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] > 2018-06-11 17:00:50.264 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.service.BackgroundJobService - Queued job: id[4727308], type[SyncActiveDirectoryGroup], site[Subscriptionsite], args[[TBX-DEPT-CRM-Contract-SU, [corp.intusurg.com](http://corp.intusurg.com), PUBLISHER]] > 2018-06-11 17:00:50.266 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\TBX-DEPT-CRM-Contract-SU has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] > 2018-06-11 17:00:50.268 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.service.BackgroundJobService - Queued job: id[4727309], type[SyncActiveDirectoryGroup], site[Subscriptionsite], args[[Revenue, [corp.intusurg.com](http://corp.intusurg.com), PUBLISHER]] > 2018-06-11 17:00:50.271 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\Revenue has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] > 2018-06-11 17:00:50.274 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.service.BackgroundJobService - Queued job: id[4727310], type[SyncActiveDirectoryGroup], site[Subscriptionsite], args[[sngsqldba, [corp.intusurg.com](http://corp.intusurg.com), PUBLISHER]] > 2018-06-11 17:00:50.276 -0700 (,,,,4727170,:enqueue\_ad\_groups\_sync,-) pool-21-thread-1 : INFO com.tableausoftware.model.workgroup.workers.EnqueueActiveDirectoryGroupSyncWorker - Sync group background job for group [corp.intusurg.com](http://corp.intusurg.com)\sngsqldba has been scheduled. Site id=[3], schedule\_name= [internal\_ad\_sync\_schedule] I want to fetch fields like, nomenclature can vary: (i) Environment details like UAT, Default (ii) Ticket No. like 4727180 (iii) Status: success or failure (iv) Time: total time taken to process (v) Process Name I am using file beat in input > input > { > beats { > port =\> 5042 > codec =\> multiline > { > pattern =\> ",2.0" > what =\> "previous" > negate =\>"true" > charset =\> "ISO-8859-1" > } > } > } > filter > { > > if "security" in [type]{ > grok { > match =\> {"message" =\> ",(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_), > (?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_), > (?[^,]_),(?[^,]_),(?[^,]_),(?[^,]_),(?[^,]\*),"} > } > mutate > { > ,remove\_tag =\> ["multiline"], > remove\_field =\> ["m1","m4","m6","m2","m5","m22"] > strip =\> ["DateTime"] > } > date { > match =\> ["DateTime", "YYYY MM dd HH:mm:ss:SSS"] > timezone =\> "EST" > target =\> "DateTime" > } > } > > } > > output { > > if "security" in [type]{ > elasticsearch { > hosts =\> ["10.103.23.224"] > index =\> "test" > } > } > > ,file{ > , path=\>"D:\systeminfolog2.txt" > ,} > } Please suggest me correct pattern to read log file. > input > { > file { > path =\> "D:\Intitutive\logfile\backgrounder-0.log" > } > } > filter > { > grok { > > ``` > match => {"message" => "(?.*?) \(\,\,\,\,(?%{INT}.*?)\,\:(?.*?)\,\-\) (?[a-zA-Z0-9._-]+) \: (?%{WORD}) (?.*)"} > > ``` > > } > > } > > output { > > ``` > elasticsearch { > hosts => ["10.103.23.224"] > index => "nine" > } > > ``` > > file{ > path=\>"D:\systeminfolog9.txt" > } > } > I have used above pattern but it wont work .I can see my logstash stared successfully but neither my index created nor file copied in to specified path. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 6, 2018, 12:05pm UTC](https://discuss.elastic.co/t/required-logstash-grok-pattern-to-read-tableau-server-log/139162/2 "2018-08-06T12:05:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.