# Unable to create logstash pattern using grok for below

**URL:** <https://discuss.elastic.co/t/unable-to-create-logstash-pattern-using-grok-for-below/150997>\
**Category:** Logstash\
**Created:** [October 4, 2018, 8:26am UTC](https://discuss.elastic.co/t/unable-to-create-logstash-pattern-using-grok-for-below/150997 "2018-10-04T08:26:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hanit\_grover](https://avatars.discourse-cdn.com/v4/letter/h/dbc845/32.png) [@Hanit\_grover](https://discuss.elastic.co/u/Hanit_grover)\
**Post date:** [October 4, 2018, 8:26am UTC](https://discuss.elastic.co/t/unable-to-create-logstash-pattern-using-grok-for-below/150997/1 "2018-10-04T08:26:14Z")

</div>

INFO 2018-09-26 18:55:10,802 [[logging\_framework].HTTP\_Listener\_Configuration.worker.01] com.temp.analytics.Logger: {"flowLevel":"subflow","apiName":"test\_MainFlow","transactionId":"df782540-c169-11e8-8c83-40b89aa3f91a","sourceSystemName":"MMO","sourceSystemIP":"null","sourceSystemURL":"/test/account","HTTPHeaders":"{http.version=HTTP/1.1, accept-encoding=gzip, deflate, http.remote.address=/127.0.0.1:61393, connection=keep-alive, http.uri.params=ParameterMap{[]}, sourcesystemurl=/test/account, postman-token=0c501fd3-fc7f-4cb5-a65e-1f93812682bc, http.relative.path=/testLogger, http.listener.path=/testLogger, http.request.uri=/testLogger, http.method=GET, cache-control=no-cache, targetsystemname=janrain, http.query.params=ParameterMap{[]}, host=localhost:8081, user-agent=PostmanRuntime/6.1.6, sourcesystemname=MMO, accept=_/_, http.scheme=http, http.request.path=/testLogger, http.query.string=}","resource":"/testLogger","HTTPOperation":"GET","applicationName":"logging\_framework","applicationURI":"/testLogger","datetimeIN":"1537952110142","targetSystemName":"janrain","dateTimeOut":"1537952110189","httpStatus":"null","errorMessage":"null","timeElapsed":"632"}

Output fields to be 🙂"flowLevel" : { "type" : "keyword" },  
"transactionId" : { "type" : "text" },  
"sourceSystemName" : { "type" : "keyword" },  
"sourceSystemIP" : { "type" : "ip" },  
"sourceSystemURL" : { "type" : "text" },  
"httpHeaders" : { "type" : "text" },  
"resource" : { "type" : "keyword" },  
"httpOperation" : { "type" : "keyword" },  
"applicationName " : { "type" : "keyword" },  
"applicationURI" : { "type" : "keyword" },  
"dateTimeIn" : { "type" : "date" },  
"targetSystemName" : { "type" : "text" },  
"dateTimeOut" : { "type" : "date" },  
"httpStatus" : { "type" : "keyword" },  
"errorMessage" : { "type" : "text" },  
"timeElapsed" : { "type" : "text" },  
"logEvenSentTime" : { "type" : "date" },  
"apiName" : { "type" : "keyword" }

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [October 4, 2018, 11:54am UTC](https://discuss.elastic.co/t/unable-to-create-logstash-pattern-using-grok-for-below/150997/2 "2018-10-04T11:54:37Z")

</div>

This is a great tool for you to create a GROK pattern to match what you want:  
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)  
Give it a shot and maybe post your GROK pattern after you've tried it yourself first and then someone can help you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2018, 11:54am UTC](https://discuss.elastic.co/t/unable-to-create-logstash-pattern-using-grok-for-below/150997/3 "2018-11-01T11:54:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.