# Unable to parse Grok Filter on Proxy Logs

**URL:** <https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194>\
**Category:** Logstash\
**Created:** [March 20, 2017, 3:03am UTC](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194 "2017-03-20T03:03:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![supercup](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@supercup](https://discuss.elastic.co/u/supercup)\
**Post date:** [March 20, 2017, 3:03am UTC](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194/1 "2017-03-20T03:03:31Z")

</div>

I am attempting to parse and structured a raw proxy data using GROK filter in the ELK stack and I can,t get the timestamp and user agent string in the correct format. Do refer to sample log as follows:

"1488852784.440 1 10.11.62.19 TCP\_DENIED/403 0 GET [http://xxx.xxx.com/xxx](http://xxx.xxx.com/xxx) - NONE/- - BLOCK\_WEBCAT\_12-XXX-XXX-NONE-NONE-NONE-NONE \<IW\_aud,0.0,-,""-"",-,-,-,-,""-"",-,-,-,""-"",-,-,""-"",""-"",-,-,IW\_aud,-,""-"",""-"",""Unknown"",""Unknown"",""-"",""-"",0.00,0,-,""-"",""-"",-,""-"",-,-,""-"",""-""\> - L ""[http://xxx.xxx.xxx](http://xxx.xxx.xxx)"" 10.11.11.2 - 403 TCP\_DENIED ""Streaming Audio"" - - - GET ""Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"" [http://xxx.xxx.xxx](http://xxx.xxx.xxx)"

I am using the following filter:  
%{NUMBER:timestamp}%{SPACE}%{NUMBER:request\_msec:float} %{IPORHOST:src\_ip} %{WORD}/%{NUMBER:response\_status:int} %{NUMBER:response\_size} %{WORD:http\_method} (%{URIPROTO:http\_proto}://)?%{IPORHOST:dst\_host}(?::%{POSINT:port})?(?:%{NOTSPACE:uri\_param})? %{USERNAME:user} %{WORD}/(%{IPORHOST:dst\_ip}|-)%{GREEDYDATA:content\_type}

based on [http://grokconstructor.appspot.com](http://grokconstructor.appspot.com), I am able to parse out some of the fields except the timestamp (1488852784.440) and User Agent String. I have tried different Drok default filters on the timestamp but it still shows as numbers.

thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 20, 2017, 6:38am UTC](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194/2 "2017-03-20T06:38:32Z")

</div>

> I have tried different Drok default filters on the timestamp but it still shows as numbers.

Well... it _is_ a number. If you want to turn it into a human-readable timestamp you need to use a date filter. If that doesn't answer your question, please show us what get now (use a `stdout { codec => rubydebug }` output) and what you'd like to get instead.

---

<div class="post-metadata">

**Author:** ![supercup](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@supercup](https://discuss.elastic.co/u/supercup)\
**Post date:** [March 21, 2017, 7:50am UTC](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194/3 "2017-03-21T07:50:55Z")

</div>

hello magnus,

I am getting the following in logstash upon executing the conf file:

"timestamp" =\> "1488852784.674",  
"tags" =\> [  
[0] "\_dateparsefailure"

my date filter is as such:

match =\> ["timestamp" , "yyyy-MM-dd HH:mm:ss"]

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 21, 2017, 8:05am UTC](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194/4 "2017-03-21T08:05:53Z")

</div>

Your `timestamp` field doesn't contain a yyyy-MM-dd date so this shouldn't be surprising. Use `UNIX` as your date pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2017, 8:05am UTC](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194/5 "2017-04-18T08:05:55Z")

</div>

Closed on April 18, 2017, 8:05am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.