# Store temporary variable

**URL:** https://discuss.elastic.co/t/store-temporary-variable/222978
**Category:** Logstash
**Created:** [March 10, 2020, 4:34pm UTC](https://discuss.elastic.co/t/store-temporary-variable/222978 "2020-03-10T16:34:33Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![hederi](https://avatars.discourse-cdn.com/v4/letter/h/ce73a5/32.png) [@hederi](https://discuss.elastic.co/u/hederi)
#### Post date: [March 10, 2020, 4:34pm UTC](https://discuss.elastic.co/t/store-temporary-variable/222978/1 "2020-03-10T16:34:34Z")

</div>

Hi,

I'm parsing a log file (flexlm debug.log) and I need to combine 2 fields from different lines.  
Basically, I need to extract the date (Mon Mar 09 2020) and add it to the timestamp that appear in each line, for example, 00:12:24  
So I will get Mon Mar 09 2020 00:12:24

Log file example:

> ```
> 0:06:46 (cdslmd) (@cdslmd-SLOG@) Time: Mon Mar 09 2020 00:06:46 UTC
> 0:06:46 (cdslmd) (@cdslmd-SLOG@) In-house operation time, when, #concurrent clients
> 0:06:46 (cdslmd) (@cdslmd-SLOG@) 
> 0:06:46 (cdslmd) (@cdslmd-SLOG@) === Active Connections Info ===
> 0:06:46 (cdslmd) (@cdslmd-SLOG@) Peak active connections #535 attempted at Sun Mar 08 2020 17:09:52 UTC
> 0:06:46 (cdslmd) (@cdslmd-SLOG@) 
> 0:06:46 (cdslmd) (@cdslmd-SLOG@) ===============================================
> 0:12:24 (cdslmd) DENIED: "Virtuoso_Acceler_Parallel_sc" yur@flexx603 (Licensed number of users already reached. (-4,342))
> 
> ```

There was a solution [flexlm-license-elk](https://github.com/sergioedo/flexlm-license-elk) that uses memorize which is a deprecated plugin and use an old Logstash version.

I was able to write grok patterns to match both lines, but I'm failing to extract the date and merge it with the timestamp

My filter setting in logstash.conf:

```
filter {
grok {
match => ["message", "%{DATA:checkoutTime} \(%{DATA:vendorName}\) (?<action>(DENIED))\: \"%{DATA:featureName}\" %{DATA:userName}@%{HOSTNAME:serverName}.* \(%{GREEDYDATA:reason}\."]
}
mutate { remove_field => ["@version", "@timestamp", "host", "message"] }
}

```

I able to parse the date with:

```
grok {
      match => ["message", "(?<date>%{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME}\s*(?:[APMCE][SD]T|UTC))"]
    }

```

Please assist!  
Thanks.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 10, 2020, 5:11pm UTC](https://discuss.elastic.co/t/store-temporary-variable/222978/2 "2020-03-10T17:11:44Z")

</div>

See [this](https://discuss.elastic.co/t/help-with-processing-metadata-at-start-of-file/220740/2) post.

---

<div class="post-metadata">

### Author: ![hederi](https://avatars.discourse-cdn.com/v4/letter/h/ce73a5/32.png) [@hederi](https://discuss.elastic.co/u/hederi)
#### Post date: [March 11, 2020, 9:37am UTC](https://discuss.elastic.co/t/store-temporary-variable/222978/3 "2020-03-11T09:37:51Z")

</div>

Working!  
Thanks!!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 8, 2020, 9:37am UTC](https://discuss.elastic.co/t/store-temporary-variable/222978/4 "2020-04-08T09:37:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.