# Try to parse different log formats in one file?
**URL:** https://discuss.elastic.co/t/try-to-parse-different-log-formats-in-one-file/143385
**Category:** Logstash
**Created:** [August 7, 2018, 7:13pm UTC](https://discuss.elastic.co/t/try-to-parse-different-log-formats-in-one-file/143385 "2018-08-07T19:13:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)
#### Post date: [August 7, 2018, 7:13pm UTC](https://discuss.elastic.co/t/try-to-parse-different-log-formats-in-one-file/143385/1 "2018-08-07T19:13:30Z")
Hi, I have situation where two different formats end up in the same log file.
I have the standard log4j format and that parses fine. But I also get google glog format.
The glog looks like:
> I0807 19:07:40.477815 13465 checker\_process.cpp:972] HTTP health check for task 'auth-api-stg-raange.c1681d01-95c2-11e8-818f-1a706db5e5af' returned: 200
The log4j pattern works as the message does not get tagged as \_grokparsefailure.
This is the filter I'm using
> grok {
> patterns\_dir =\> "patterns/"
> match =\> {
> "message" =\>
> [
> "%{TIMESTAMP\_ISO8601:log\_timestamp} [%{NOTSPACE:thread}] %{LOGLEVEL:log\_level} \* (?[A-Za-z0-9$\_.]+) - %{GREEDYDATA:log\_message}",
> "%{LOGLEVEL:log\_level}%{TIMESTAMP\_GLOG:log\_timestamp} %{GREEDYDATA:log\_message}"
> ]
> }
> }
GLOG pattern is defined as:
> TIMESTAMP\_GLOG %{MONTHNUM}%{MONTHDAY} %{TIME}
---
### Author:  [@chandra0651](https://discuss.elastic.co/u/chandra0651)
#### Post date: [August 7, 2018, 8:13pm UTC](https://discuss.elastic.co/t/try-to-parse-different-log-formats-in-one-file/143385/2 "2018-08-07T20:13:52Z")
I came across this situation in one of my implementation , i wrote two grok's in filter section something like beloe , please ignore the syntax
```
> filter {
>
> grok {
grok pattern for first log
> }
> if [_grokparsefailure] in [tags] {
> grok {
grok pattern for second type of log
> }
> if [GreedyData field] {
> remove "grokeparsefailure" from tags
> }
> }
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 8, 2018, 6:03am UTC](https://discuss.elastic.co/t/try-to-parse-different-log-formats-in-one-file/143385/3 "2018-08-08T06:03:14Z")
The grok expression you have for the glog file doesn't match that actual log because LOGLEVEL doesn't match "I". Try e.g. `(?\w)%{TIMESTAMP_GLOG}...` instead.
---
### Author:  [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)
#### Post date: [August 10, 2018, 3:57pm UTC](https://discuss.elastic.co/t/try-to-parse-different-log-formats-in-one-file/143385/4 "2018-08-10T15:57:03Z")
Ok I will try when I have a bit of time. Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2018, 3:57pm UTC](https://discuss.elastic.co/t/try-to-parse-different-log-formats-in-one-file/143385/5 "2018-09-07T15:57:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.