# Unable to Parse logs using filter{} in Logstash
**URL:** https://discuss.elastic.co/t/unable-to-parse-logs-using-filter-in-logstash/52763
**Category:** Logstash
**Created:** [June 14, 2016, 5:12pm UTC](https://discuss.elastic.co/t/unable-to-parse-logs-using-filter-in-logstash/52763 "2016-06-14T17:12:29Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@nishant\_goel](https://discuss.elastic.co/u/nishant_goel)
#### Post date: [June 14, 2016, 5:12pm UTC](https://discuss.elastic.co/t/unable-to-parse-logs-using-filter-in-logstash/52763/1 "2016-06-14T17:12:29Z")
Hi,
I want to parse a log but I am not able to achieve this. I am getting no output on my console. Whenever I run logstash using the command:
bin/logstash -f firstInput.conf --debug
I get this:
Starting pipeline {:id=\>"main", :pipeline\_workers=\>8, :batch\_size=\>125, :batch\_delay=\>5, :max\_inflight=\>1000, :level=\>:info, :file=\>"logstash/pipeline.rb", :line=\>"188", :method=\>"start\_workers"}
Pipeline main started {:file=\>"logstash/agent.rb", :line=\>"465", :method=\>"start\_pipeline"}
each: file grew: /Users/mac/project/Logstash/logs/access\_logs.logs: old size 0, new size 94 {:level=\>:debug, :file=\>"filewatch/watch.rb", :line=\>"254", :method=\>"each"}
each: file grew: /Users/mac/project/Logstash/logs/access\_logs.logs: old size 0, new size 94 {:level=\>:debug, :file=\>"filewatch/watch.rb", :line=\>"254", :method=\>"each"}
and this keeps on repeating.
I had written a custom regex for parsing this log which is stated below. I also checked it with grok debugger and it gave me the correct output.
"%{TIMESTAMP:timestamp} %{IPORHOST:clientip} %{IPORHOST:clientip2} %{IPORHOST:serverip} %{URI\_FRONT:uri}"
Here:
URI\_FRONT [0-9a-zA-Z\*/]_[0-9a-zA-Z]_.[a-z][a-z][a-z]
TIMESTAMP (?\>\d\d){1,2}-(?:0[1-9]|1[0-2])-(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)
The config that I am using is:
input {
file {
path =\> "/Users/macproject/Logstash/logs/access\_logs.logs"
sincedb\_path =\> "/dev/null"
start\_position =\> beginning
```
ignore_older => 0
}
```
}
filter {
```
grok {
patterns_dir => ["/Users/mac/project/Logstash/patterns"]
match => { "message" => "%{TIMESTAMP:timestamp}@~#%{IPORHOST:clientip}@~#%{IPORHOST:clientip2}@~#%{IPORHOST:serverip}@~#%{URI_FRONT:uri}" }
}
```
}
output {
```
stdout {
codec => rubydebug
}
```
}
The custom formats that I have given are being read by logstash but I am not able to get anything on my console.
Could you please help me. I am trying hard but unable to do it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/unable-to-parse-logs-using-filter-in-logstash/52763/2 "2017-07-06T04:52:26Z")