# Syntax in filter Error log

**URL:** https://discuss.elastic.co/t/syntax-in-filter-error-log/219359
**Category:** Logstash
**Tags:** docker
**Created:** [February 14, 2020, 12:08pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359 "2020-02-14T12:08:51Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![juuuhuuu](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)
#### Post date: [February 14, 2020, 12:08pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359/1 "2020-02-14T12:08:51Z")

</div>

Hi 🙂

I am a bit struggling with the syntax in logstash. I would like to filter Log Level -Error.  
In my .log I have something like timestamp applicationtest.Error messsage. Is it possible that i my errorlog I will see applicationtest.Error or just ERROR

I am using Grok filter:

grok{  
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:log-level}-%{GREEDYDATA:message}"}  
}

but I can not see the Error log.

Thank You

---

<div class="post-metadata">

### Author: ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [February 14, 2020, 12:45pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359/2 "2020-02-14T12:45:01Z")

</div>

Hi,

please add examples of the exact log lines that you are using as input and the expected results that you want.

Probably some tests in [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) will help you to get your match patterns right.

---

<div class="post-metadata">

### Author: ![juuuhuuu](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)
#### Post date: [February 14, 2020, 1:11pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359/3 "2020-02-14T13:11:06Z")

</div>

Thank you for your reply.

---

<div class="post-metadata">

### Author: ![juuuhuuu](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)
#### Post date: [February 14, 2020, 1:42pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359/4 "2020-02-14T13:42:15Z")

</div>

log lines is : [2020-01-03 11:16:50] applicationtest.ERROR: message ahoj jak se mas

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 14, 2020, 4:51pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359/5 "2020-02-14T16:51:35Z")

</div>

You could dissect that

```
dissect { mapping => { "message" => "[%{timestamp}] %{something}.%{loglevel}: %{errormessage}" } }
```

---

<div class="post-metadata">

### Author: ![juuuhuuu](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)
#### Post date: [February 15, 2020, 3:23pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359/7 "2020-02-15T15:23:44Z")

</div>

thank You very much .. ill try it

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 14, 2020, 3:36pm UTC](https://discuss.elastic.co/t/syntax-in-filter-error-log/219359/8 "2020-03-14T15:36:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.