# Windows log text file data is not parsing logstash

**URL:** <https://discuss.elastic.co/t/windows-log-text-file-data-is-not-parsing-logstash/224345>\
**Category:** Logstash\
**Created:** [March 20, 2020, 3:48am UTC](https://discuss.elastic.co/t/windows-log-text-file-data-is-not-parsing-logstash/224345 "2020-03-20T03:48:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sayyadsays](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@sayyadsays](https://discuss.elastic.co/u/sayyadsays)\
**Post date:** [March 20, 2020, 3:48am UTC](https://discuss.elastic.co/t/windows-log-text-file-data-is-not-parsing-logstash/224345/1 "2020-03-20T03:48:47Z")

</div>

Can you please check and help:

## Find the below Logs need to monitor:

Timestamp: 12/24/2019 5:42:04 AM

Message: Task timed out - SKKW is not responding in timely manner

Category: Error

Priority: -1

EventId: 1

Severity: Information

Title:

Machine: AIAWGS001

App Domain: /LM/W3RDS/64/ROOT/UXP.Services/IeeRaa/UMP.Services.IeeRaa.UserServices-301-132216577167216650

ProcessId: 15068

Process Name: c:\windows\system32\inetsrv\w3wp.exe

Thread Name:

Win32 ThreadId:19512

Extended Properties:

WebSession - BC720.BC720@Q7T0+cK7Bf4UOzfKe9F8HUv6yC4=

* * *

**Find the below logstash file trying:**  
input {  
file {  
path =\> ["/D:/LT\_Logs\_Montoring/Logsfile/UXP.Services.OneView.UserServices.2019-12-23.23\_v1.txt"]  
start\_position =\> "beginning"  
codec =\> multiline {  
pattern =\> "+"  
negate =\> true  
what =\> previous  
sincedb\_path =\> "/dev/null"  
}  
}  
}

filter {  
if "multiline" not in [tags] {  
drop {}  
}

grok {

match =\> {"message" =\> "Timestamp : %{NOTSPACE:date}\r\nMessage : %{DATA:message}\r\nCategory : %{NOTSPACE:file}"}

}

}

output {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200/)"]  
index =\> "onetestlogfile"  
}  
}

using above setting in conf file.

Error: " **java illegal exception ,Dont no how to handle i**" Please find the attached screen shot

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bd6b216f58e499c1066853825428aed9d2a0ffc9.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2020, 4:32pm UTC](https://discuss.elastic.co/t/windows-log-text-file-data-is-not-parsing-logstash/224345/2 "2020-03-22T16:32:21Z")

</div>

Please do not post pictures of text, just post the text. Also, please format your post using [markdown](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet) to format your posts if you expect folks to read them. Specifically [code quoting](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet#code).

Your configurations should

```
 look like
 this

```

in the preview pane on the right of the editing pane.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2020, 4:32pm UTC](https://discuss.elastic.co/t/windows-log-text-file-data-is-not-parsing-logstash/224345/3 "2020-04-19T16:32:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.