# Can someone pls help me with my logstash parsers

**URL:** <https://discuss.elastic.co/t/can-someone-pls-help-me-with-my-logstash-parsers/228705>\
**Category:** Logstash\
**Created:** [April 19, 2020, 7:26am UTC](https://discuss.elastic.co/t/can-someone-pls-help-me-with-my-logstash-parsers/228705 "2020-04-19T07:26:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [April 19, 2020, 7:26am UTC](https://discuss.elastic.co/t/can-someone-pls-help-me-with-my-logstash-parsers/228705/1 "2020-04-19T07:26:42Z")

</div>

Hi Guys,

Somehow my grok pattern is not working and can someone please help?  
Here is original message

```auto
2020-04-18 13:02:20,391 INFO [ImapSSLServer-345] [ip=171.51.237.87;ua=com.samsung.android.email.provider;] security - cmd=Auth; account=aaaaa@bbbbb.com; protocol=imap;

```

And here are my parsers

```auto
%{TIMESTAMP_ISO8601:timestamp} %{WORD:level}%{SPACE:space}\[%{WORD:gibber}\]\[%{WORD:ip}\=%{IP:src_ip}\;%{WORD:UserAgent}\=%{DATA:data}\;\] %{WORD:method} \- cmd=Auth\; %{WORD:account}\=%{GREEDYDATA:emailAddress}\; %{DATA=protocol}\=%{WORD:proto}\;"

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 19, 2020, 3:06pm UTC](https://discuss.elastic.co/t/can-someone-pls-help-me-with-my-logstash-parsers/228705/2 "2020-04-19T15:06:09Z")

</div>

Your pattern does not appear to allow a space between the first ] and the following [.

I suggest you read [this](https://discuss.elastic.co/t/help-needed-in-grok/213827/2).

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [April 19, 2020, 6:02pm UTC](https://discuss.elastic.co/t/can-someone-pls-help-me-with-my-logstash-parsers/228705/3 "2020-04-19T18:02:26Z")

</div>

> [@Blason](#):
>
> 2020-04-18 13:02:20,391 INFO [ImapSSLServer-345] [ip=171.51.237.87;ua=com.samsung.android.email.provider;] security - cmd=Auth; [account=aaaaa@bbbbb.com](mailto:account=aaaaa@bbbbb.com); protocol=imap;

Are you talking about ] [?

```auto
345] [ip

```

In Fact even after that I still do not have any luck

```auto
       "message" => "2020-04-18 13:02:20,391 INFO [ImapSSLServer-345] [ip=171.51.237.87;ua=com.samsung.android.email.provider;] security - cmd=Auth; account=zzzz@yyyy.com; protocol=imap;",
          "tags" => [
        [0] "_grokparsefailure"
    ],
      "@version" => "1",
    "@timestamp" => 2020-04-19T18:01:44.824Z,
          "host" => "traplox"

```

Here is my config

```auto
        match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{WORD:level}%{SPACE:space}\[%{WORD:gibber}\]\s*\[%{WORD:ip}\=%{IP:src_ip}\;%{WORD:UserAgent}\=%{DATA:da
ta}\;\]\s*%{WORD:method}\s*\-\s*cmd\=Auth\;\s*%{WORD:account}\=%{GREEDYDATA:emailAddress}\;\s*%{DATA=protocol}\=%{WORD:proto}\;"}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 19, 2020, 7:49pm UTC](https://discuss.elastic.co/t/can-someone-pls-help-me-with-my-logstash-parsers/228705/4 "2020-04-19T19:49:59Z")

</div>

Again, I suggest you read the post I linked to and build the pattern one field at a time.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2020, 7:50pm UTC](https://discuss.elastic.co/t/can-someone-pls-help-me-with-my-logstash-parsers/228705/5 "2020-05-17T19:50:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.