# Basic logstash grok pattern - need help

**URL:** <https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140>\
**Category:** Logstash\
**Created:** [November 2, 2017, 8:37am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140 "2017-11-02T08:37:02Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 2, 2017, 8:37am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/1 "2017-11-02T08:37:02Z")

</div>

Hi Guys,

I have file this and I am trying to build a pattern for the same. Somehow this is not working. Can some one please help

/var/log/badhost.txt =  
125.118.243.164  
216.245.208.133  
199.59.242.150  
104.145.232.3  
.  
.  
.  
.  
.

input {  
# add necessary input parameters  
file {  
type =\> "threat-intel"  
path =\> "/var/log/badhost.txt"  
}  
}

filter {  
if [type] == "threat-intel" {  
grok {  
match =\> { "message =\>"%{ clientip:IPV4}"  
"geoip": {  
"field": "clientip"  
}  
}

---

<div class="post-metadata">

**Author:** ![bad-smruti](https://avatars.discourse-cdn.com/v4/letter/b/3bc359/32.png) [@bad-smruti](https://discuss.elastic.co/u/bad-smruti)\
**Post date:** [November 2, 2017, 8:51am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/2 "2017-11-02T08:51:48Z")

</div>

The basic syntax for GROK Pattern is %{SYNTAX:SEMANTIC}. So you need to change %{ clientip:IPV4} this :

> [@Blason](#):
>
> match =\> { "message =\>"%{ clientip:IPV4}"

to

> %{IPV4:clientip}

Refer this for the basic grok filter : [Grok filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)

.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 2, 2017, 9:55am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/3 "2017-11-02T09:55:11Z")

</div>

Thanks I am complete novice to Logstash and learning bit by bit ..Thnks for the info though 🙂

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 2, 2017, 11:41am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/4 "2017-11-02T11:41:59Z")

</div>

```
`input {

```

beats {  
port =\> 5044  
}  
}

filter {  
if [type] == "threat-intel" {  
grok {  
match =\> { "message" =\> "%{IPV4:clientip}"

```
    geoip {
            {
                    source => "clientip"
                    }
              }
            }
    }

```

}  
output {  
elasticsearch {  
hosts =\> "192.168.1.15:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}  
`

Any clue with this config I am not able to parse geo tagging and I am accepting data over filebeat.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 2, 2017, 1:08pm UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/5 "2017-11-02T13:08:00Z")

</div>

You've put your geoip filter inside your grok filter, i.e. your curly braces are mismatched.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 3, 2017, 5:08am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/6 "2017-11-03T05:08:11Z")

</div>

Hey there,

Is there any sample config that I can refer to? I mean these are just a simple IP addresses with Line break.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2017, 6:23am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/7 "2017-11-03T06:23:41Z")

</div>

Well, in this case you don't need a grok filter since the lines as you say only contain the IP address. Just point the geoip filter at the `message` field, or use a mutate filter to rename `message` to `clientip` or whatever you prefer.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 3, 2017, 6:33am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/8 "2017-11-03T06:33:47Z")

</div>

so in my case it would just be match =\> Message?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2017, 6:38am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/9 "2017-11-03T06:38:42Z")

</div>

No, drop the grok filter completely.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 3, 2017, 7:13am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/10 "2017-11-03T07:13:52Z")

</div>

If you dont mind would you please give me sample snippet? Plss? My use case is simple just have IP addresses and need to parse and tag with Geo\_points

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2017, 8:00am UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/11 "2017-11-03T08:00:07Z")

</div>

```nohighlight
geoip {
  source => "message"
}

```

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [November 3, 2017, 1:22pm UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/12 "2017-11-03T13:22:17Z")

</div>

Thanks man.. I really appreciate that 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2017, 1:22pm UTC](https://discuss.elastic.co/t/basic-logstash-grok-pattern-need-help/106140/13 "2017-12-01T13:22:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.