### Author:  [@dbviz](https://discuss.elastic.co/u/dbviz)
#### Post date: [February 21, 2020, 1:40pm UTC](https://discuss.elastic.co/t/trying-to-parse-when-loglevel-is-error/220378/1 "2020-02-21T13:40:28Z")
Hello,
Im trying to parse only LOGLEVEL field using grok but it doesn't work.
My logstash.log comes from :
`[2020-02-20T15:55:46,198][ERROR][logstash.inputs.jdbc] Java::ComSybaseJdbc3Jdbc::SybSQLException: Difference of two datetime fields caused overflow at runtime.:`
`[2020-02-20T16:27:36,610][INFO][logstash.pipeline] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#"}`
and the grock filter
```
input {
file {
path => "/logs/logstash-plain-duplicate.log"
}
}
#############
#############
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} \s+[%{JAVACLASS:class}] %{GREEDYDATA:message} " }
}
mutate{
add_field =>{
"lvl" => "%{LOGLEVEL}"
}
}
}
#############
#############
output {
stdout { codec => rubydebug }
}
```
And here is the result :
```
{
"@version" => "1",
"path" => "/logs/logstash-plain-duplicate.log",
"host" => "SERV100",
"@timestamp" => 2020-02-21T13:38:31.138Z,
"tags" => [
[0] "_grokparsefailure"
],
"lvl" => "%{LOGLEVEL}",
"message" => "[2020-02-20T15:55:46,198][ERROR][logstash.inputs.jdbc] Java::ComSybaseJdbc3Jdbc::SybSQLException: Difference of two datetime fields caused overflow at runtime.:"
}
```
Thank you 🙂
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 21, 2020, 3:33pm UTC](https://discuss.elastic.co/t/trying-to-parse-when-loglevel-is-error/220378/2 "2020-02-21T15:33:44Z")
You grok pattern does not match the message. You need to include all the square brackets etc. in the pattern, and they will need to be escaped.
---
### Author:  [@dbviz](https://discuss.elastic.co/u/dbviz)
#### Post date: [February 21, 2020, 3:51pm UTC](https://discuss.elastic.co/t/trying-to-parse-when-loglevel-is-error/220378/3 "2020-02-21T15:51:18Z")
> [@dbviz](#):
>
> grok
Thank you Badger for your reply.
I used [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) to compare with grok pattern but its not working
---
### Author:  [@dbviz](https://discuss.elastic.co/u/dbviz)
#### Post date: [February 26, 2020, 10:00am UTC](https://discuss.elastic.co/t/trying-to-parse-when-loglevel-is-error/220378/4 "2020-02-26T10:00:21Z")
Anyone have the GROK example for this ?
> [@dbviz](#):
>
> `[2020-02-20T15:55:46,198][ERROR][logstash.inputs.jdbc] Java::ComSybaseJdbc3Jdbc::SybSQLException: Difference of two datetime fields caused overflow at runtime.:`
> `[2020-02-20T16:27:36,610][INFO][logstash.pipeline] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#"}`
---
### Author:  [@dbviz](https://discuss.elastic.co/u/dbviz)
#### Post date: [February 27, 2020, 10:44am UTC](https://discuss.elastic.co/t/trying-to-parse-when-loglevel-is-error/220378/5 "2020-02-27T10:44:36Z")
The solution :
> [%{TIMESTAMP\_ISO8601:timestamp}][%{DATA:loglevel}%{SPACE}][%{JAVACLASS:class}%{SPACE}] %{GREEDYDATA:message}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 26, 2020, 10:44am UTC](https://discuss.elastic.co/t/trying-to-parse-when-loglevel-is-error/220378/6 "2020-03-26T10:44:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.