.*)" } }
```
I added a \* to the . in drupal\_message as well. I assume you do not just want the first character of it.
---
### Author:  [@Bdr](https://discuss.elastic.co/u/Bdr)
#### Post date: [January 10, 2019, 4:17am UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/3 "2019-01-10T04:17:34Z")
> [@Bdr](#):
>
> drupalsyslog
Thanks for giving reply.
I tried with that but still I'm getting same result. I need values separately output should be like
"""
\_index: "dwl-2019.01.09",
\_type: "doc",
\_id: "vTY8MmgBNTrSTUskwpY9",
\_score: 1,
\_source: {
path: "/home/Desktop/logfiles/drupal-watchdog.log",
logsource: "",
drupal\_vhost: "",
drupal\_ip: "",
message: "Jan 3 06:28:34 10.81.157.182 shopingstore: https://secure.shopingstore.com|1546496914|product\_rest|23.194.213.4|[https://secure.shopingstore.com/api/product/part?\_format=json||1||Update](https://secure.shopingstore.com/api/product/part?_format=json%7C%7C1%7C%7CUpdate) Part request\_id="v-cb88a3a2-0f20-11e9-b27c-22000aee32e6",
@timestamp: "2019-01-09T10:50:54.603Z",
@version: "1",
type: "drupal"
""
---
### Author:  [@Makra](https://discuss.elastic.co/u/Makra)
#### Post date: [January 10, 2019, 4:42am UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/4 "2019-01-10T04:42:12Z")
@Bdr
Hi Can you post your drupal log file ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 10, 2019, 2:09pm UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/5 "2019-01-10T14:09:27Z")
With the grok I wrote and the message you gave I get
```
"logdate" => "Jan 3 06:28:34",
"drupal_vhost" => "secure.shopingstore.com",
"drupal_action" => "product_rest",
"syslogprog" => "shopingstore",
"drupal_timestamp" => "1546496914",
"drupal_request_uri" => "https://secure.shopingstore.com/api/product/part?_format=json",
"drupal_ip" => "23.194.213.4",
"message" => "Jan 3 06:28:34 10.81.157.182 shopingstore: https://secure.shopingstore.com|1546496914|product_rest|23.194.213.4|https://secure.shopingstore.com/api/product/part?_format=json||1||Update Part request_id=\"v-cb88a3a2-0f20-11e9-b27c-22000aee32e6",
"drupal_uid" => "1",
"logsource" => "10.81.157.182",
"drupal_message" => "Update Part request_id=\"v-cb88a3a2-0f20-11e9-b27c-22000aee32e6"
```
Do you not get the same?
---
### Author:  [@Bdr](https://discuss.elastic.co/u/Bdr)
#### Post date: [January 21, 2019, 6:21am UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/6 "2019-01-21T06:21:19Z")
> [@Badger](#):
>
> grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:logdate} %{IPORHOST:logsource} %{SYSLOGHOST:syslogprog}: https?://%{HOSTNAME:drupal\_vhost}|%{NUMBER:drupal\_timestamp}|(?\[^|]_)|%{IP:drupal\_ip}|(?\[^|]_)|(?\[^|]_)|(?\[^|]_)|(?\[^|]_)|(?\._)" } }
I'm not getting the same.could you post full logstash.conf file.
---
### Author:  [@Bdr](https://discuss.elastic.co/u/Bdr)
#### Post date: [January 21, 2019, 6:51am UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/7 "2019-01-21T06:51:33Z")
This is my code in logstash-watchdog.conf file
"""""""""
input {
file {
path =\> "/home/Desktop/logfiles/drupal-watchdog.log"
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
}
}
filter {
if [type] == "drupalsyslog" {
grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:logdate} %{IPORHOST:logsource} %{SYSLOGHOST:syslogprog}: https?://%{HOSTNAME:drupal\_vhost}|%{NUMBER:drupal\_timestamp}|(?\[^|]_)|%{IP:drupal\_ip}|(?\[^|]_)|(?\[^|]_)|(?\[^|]_)|(?\[^|]_)|(?\._)" } }
}
date {
locale =\> "en"
match =\> ["logdate", "dd/MMM/yyyy:HH:mm:ss Z", "MMM d HH:mm:ss" , "MMM d HH:mm:ss", "dd-MMM-yyyy HH:mm:ss ZZZ"]
}
}
output {
elasticsearch {
hosts =\> "localhost:9200"
manage\_template =\> false
index =\> "watchdg-%{+YYYY.MM.dd}"
document\_type =\> "watchdg"
}
stdout { codec =\> rubydebug }
}
""""""""""
Is it correct?
---
### Author:  [@Bdr](https://discuss.elastic.co/u/Bdr)
#### Post date: [January 21, 2019, 7:15am UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/8 "2019-01-21T07:15:17Z")
This is the log present in drupal log file.
"""Jan 3 06:28:34 10.81.157.182 shopingstore: https://secure.shopingstore.com|1546496914|product\_rest|23.194.213.4|https://secure.shopingstore.com/api/product/part?\_format=json||1||Update Part request\_id="v-cb88a3a2-0f20-11e9-b27c-22000aee32e6""""""
---
### Author:  [@Bdr](https://discuss.elastic.co/u/Bdr)
#### Post date: [January 21, 2019, 8:00am UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/9 "2019-01-21T08:00:53Z")
Thanks @Badger after removing if condition then it's working fine
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 18, 2019, 8:00am UTC](https://discuss.elastic.co/t/when-importing-drupal-watchdog-log-file-in-logstash-not-getting-fields-separated-from-message-in-elastisearch/163522/10 "2019-02-18T08:00:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.