# Can someone help with filter logic of my log file **URL:** \ **Category:** Logstash\ **Created:** [May 21, 2019, 11:18am UTC](https://discuss.elastic.co/t/can-someone-help-with-filter-logic-of-my-log-file/181983 "2019-05-21T11:18:43Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![anon69830709](https://avatars.discourse-cdn.com/v4/letter/a/e99b99/32.png) [@anon69830709](https://discuss.elastic.co/u/anon69830709)\ **Post date:** [May 21, 2019, 11:18am UTC](https://discuss.elastic.co/t/can-someone-help-with-filter-logic-of-my-log-file/181983/1 "2019-05-21T11:18:43Z")
This is my sample log. May 21 13:21:48 Network Log: NSD FAIL WAN[1] May 21 13:21:58 Network Log: NSD SUCCESS WAN[1] May 21 13:32:45 User Log: User cisco login failed. May 21 13:33:03 User Log: User cisco login success from 192.168.100.106 May 21 13:33:57 User Log: User cisco login success from 192.168.100.106 May 21 13:34:39 Network Log: NSD FAIL WAN[1] May 21 13:34:59 Network Log: NSD SUCCESS WAN[1] May 21 13:36:58 VPN Log: (Tunnel disconnect) ,in=0,src=,got IP=192.168.100.150 cause : link disconnect May 21 13:37:23 VPN Log: Terminating on signal 15 May 21 13:37:29 VPN Log: Connection terminated. May 21 13:37:29 VPN Log: Modem hangup May 21 13:37:29 VPN Log: Exit. May 21 13:37:49 VPN Log: (Tunnel established) user1,in=0,src=10.11.12.13,got IP=192.168.100.150 May 21 13:37:52 VPN Log: MPPE 128-bit stateless compression enabled May 21 13:37:52 VPN Log: local LL address fe80::94cc:380b:d430:127f May 21 13:37:52 VPN Log: remote LL address fe80::1853:0ed298cf:9bb9 May 21 13:37:53 VPN Log: found interface eth0 for proxy arp May 21 13:37:53 VPN Log: local IP address 192.168.100.1 May 21 13:37:53 VPN Log: remote IP address 192.168.100.150 May 21 13:37:59 Network Log: NSD FAIL WAN[1] May 21 13:38:10 Network Log: NSD SUCCESS WAN[1] May 21 13:43:10 User Log: User cisco Session Expired May 21 13:43:47 VPN Log: No response to 5 echo-requests May 21 13:43:47 VPN Log: Serial link appears to be disconnected. May 21 13:43:47 VPN Log: Connect time 5.9 minutes. May 21 13:43:47 VPN Log: Sent 1330585 bytes, received 107319 bytes. May 21 13:43:47 VPN Log: MPPE disabled May 21 13:43:47 VPN Log: (Tunnel disconnect) user1,in=0,src=10.11.22.33,got IP=192.168.100.150 cause : log out May 21 13:43:50 VPN Log: (Tunnel disconnect) user1,in=0,src=10.11.12.13,got IP=192.168.100.150 cause : log out May 21 13:43:50 VPN Log: Connection terminated. May 21 13:43:50 VPN Log: Connect time 5.9 minutes. May 21 13:43:50 VPN Log: Sent 1330585 bytes, received 107319 bytes. May 21 13:43:51 VPN Log: Modem hangup May 21 13:44:21 VPN Log: Exit. After **Log:** part i am concerned about src ip and cause. I am trying > ``` > filter{ > grok { > match => { > "message" => "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:logsource} %{PROG:program}.*src=%{IP:IP}.*: %{GREEDYDATA:Reason}" > } > } > } > > ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 21, 2019, 12:52pm UTC](https://discuss.elastic.co/t/can-someone-help-with-filter-logic-of-my-log-file/181983/2 "2019-05-21T12:52:40Z")
The IP is followed by a comma, not ": ". Try ``` "message" => "^%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:logsource} %{PROG:program}.*src=%{IP:IP},%{GREEDYDATA:Reason}" ``` Anchoring your pattern with ^ will give you better performance. ---
**Author:** ![anon69830709](https://avatars.discourse-cdn.com/v4/letter/a/e99b99/32.png) [@anon69830709](https://discuss.elastic.co/u/anon69830709)\ **Post date:** [May 22, 2019, 4:33am UTC](https://discuss.elastic.co/t/can-someone-help-with-filter-logic-of-my-log-file/181983/3 "2019-05-22T04:33:33Z")
If i use this pattern some lines will get grok pattern failure.So how can i make sure that this pattern is matched only in specific lines. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 19, 2019, 4:33am UTC](https://discuss.elastic.co/t/can-someone-help-with-filter-logic-of-my-log-file/181983/4 "2019-06-19T04:33:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.