# Code failure

**URL:** <https://discuss.elastic.co/t/code-failure/124939>\
**Category:** Logstash\
**Created:** [March 21, 2018, 9:08am UTC](https://discuss.elastic.co/t/code-failure/124939 "2018-03-21T09:08:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![PAU\_SUREDA\_COLL](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@PAU\_SUREDA\_COLL](https://discuss.elastic.co/u/PAU_SUREDA_COLL)\
**Post date:** [March 21, 2018, 9:08am UTC](https://discuss.elastic.co/t/code-failure/124939/1 "2018-03-21T09:08:51Z")

</div>

I try to parse my code for fortigate logs.  
I need to combine two fields in a new one, but i want Kibana show me only the values with some content inside. Can you explain me how to do it?

My code:  
filter{  
grok{  
match =\> [  
"message",  
"%{SYSLOG5424PRI:syslog\_index}%{GREEDYDATA:message}"  
]  
overwrite =\> ["message"]  
tag\_on\_failure =\> ["failure\_grok\_fortigate"]

}  
kv{  
source =\> "message"  
value\_split =\> "="  
field\_split =\> ","  
}  
}  
mutate {  
add\_field =\> { "IP\_destino" =\> "%{remip} %{dstip}"  
"Puerto\_dest" =\> %{remport} %{dstport}”

}  
rename =\> { "type" =\> "tipo" }  
rename =\> { "subtype" =\> "subtipo" }  
rename =\> { "devname" =\> "nombre\_equipo" }  
rename =\> { "devid" =\> "id\_equipo" }  
rename =\> { "logid" =\> "id\_log" }  
rename =\> { "level" =\> "nivel" }  
rename =\> { "logdesc" =\> "descripcion\_log" }  
rename =\> { "locip" =\> "ip\_locsl" }  
rename =\> { "action" =\> "accion" }  
rename =\> { "user" =\> "usuario" }  
rename =\> { "group" =\> "grupo" }  
rename =\> { "xauthuser" =\> "x\_auth\_usuario" }  
rename =\> { "xauthgroup" =\> "x\_auth\_grupo" }  
rename =\> { "assignip" =\> "ip\_asignada" }  
rename =\> { "vpntunnel" =\> "tunel\_vpn" }  
rename =\> { "status" =\> "estado" }  
rename =\> { "mode" =\> "modo" }  
rename =\> { "stage" =\> "fase" }  
rename =\> { "role" =\> "rol" }  
rename =\> { "result" =\> "resultado" }  
rename =\> { "totalsesion" =\> "sesiones\_totales" }  
rename =\> { "bandwidth" =\> "ancho\_banda" }  
rename =\> { "tunnelid" =\> "tunel\_id" }  
rename =\> { "tunneltype" =\> "tunel\_tipo" }  
rename =\> { "tunnelip" =\> "tunel\_ip" }  
rename =\> { "duration" =\> "duracion" }  
rename =\> { "sentbyte" =\> "byte\_enviado" }  
rename =\> { "rcvdbyte" =\> "byte\_recibido" }  
rename =\> { "srcip" =\> "ip\_origen" }  
rename =\> { "srcport" =\> "puerto\_origen" }  
rename =\> { "destinf" =\> "informscion\_destino" }  
rename =\> { "sessionid" =\> "id\_sesion" }  
rename =\> { "policyid" =\> "politica\_id" }  
rename =\> { "policytype" =\> "politica\_tipo" }  
rename =\> { "dstcountry" =\> "pais\_destino" }  
rename =\> { "srccountry" =\> "pais\_origen" }  
rename =\> { "service" =\> "servico" }  
rename =\> { "sentpkt" =\> "pkt\_enviado" }  
rename =\> { "crscore" =\> "cr\_puntuacion" }  
rename =\> { "craction" =\> "cr\_accion" }  
rename =\> { "crlevel" =\> "cr\_nivel" }  
remove\_field =\> ["dstip", "dstport", "remip", "remport"]  
}

I try to make an "IF / ELSE" template but it doesn't work and i don't kwon why.

IF/ELSE code:  
filter  
{  
grok  
{  
match =\>  
[  
"message","%{SYSLOG5424PRI:syslog\_index}%{GREEDYDATA:message}"  
]  
overwrite =\> ["message"]  
tag\_on\_failure =\> ["failure\_grok\_fortigate"]

}  
kv{  
source =\> "message"  
value\_split =\> "="  
field\_split =\> " "  
}  
if [remip] {  
mutate {  
add\_field =\> [  
"IP\_destino" =\> "%{remip}"  
"Puerto\_dest" =\> "%{remport}"  
]  
}  
}  
else if [dstip] {  
mutate {  
add\_field =\> [  
"IP\_destino" =\> "%{dstip}"  
"Puerto\_dest" =\> "%{dstport}"  
]  
}  
}  
else {  
remove\_field =\> ["remip", "remport", "dstip", "dstport"]  
}

mutate {  
rename =\> { "type" =\> "tipo" }  
rename =\> { "subtype" =\> "subtipo" }  
rename =\> { "devname" =\> "nombre\_equipo" }  
rename =\> { "devid" =\> "id\_equipo" }  
rename =\> { "logid" =\> "id\_log" }  
rename =\> { "level" =\> "nivel" }  
rename =\> { "logdesc" =\> "descripcion\_log" }  
rename =\> { "locip" =\> "ip\_locsl" }  
rename =\> { "action" =\> "accion" }  
rename =\> { "user" =\> "usuario" }  
rename =\> { "group" =\> "grupo" }  
rename =\> { "xauthuser" =\> "x\_auth\_usuario" }  
rename =\> { "xauthgroup" =\> "x\_auth\_grupo" }  
rename =\> { "assignip" =\> "ip\_asignada" }  
rename =\> { "vpntunnel" =\> "tunel\_vpn" }  
rename =\> { "status" =\> "estado" }  
rename =\> { "mode" =\> "modo" }  
rename =\> { "stage" =\> "fase" }  
rename =\> { "role" =\> "rol" }  
rename =\> { "result" =\> "resultado" }  
rename =\> { "totalsesion" =\> "sesiones\_totales" }  
rename =\> { "bandwidth" =\> "ancho\_banda" }  
rename =\> { "tunnelid" =\> "tunel\_id" }  
rename =\> { "tunneltype" =\> "tunel\_tipo" }  
rename =\> { "tunnelip" =\> "tunel\_ip" }  
rename =\> { "duration" =\> "duracion" }  
rename =\> { "sentbyte" =\> "byte\_enviado" }  
rename =\> { "rcvdbyte" =\> "byte\_recibido" }  
rename =\> { "srcip" =\> "ip\_origen" }  
rename =\> { "srcport" =\> "puerto\_origen" }  
rename =\> { "destinf" =\> "informacion\_destino" }  
rename =\> { "sessionid" =\> "id\_sesion" }  
rename =\> { "policyid" =\> "politica\_id" }  
rename =\> { "policytype" =\> "politica\_tipo" }  
rename =\> { "dstcountry" =\> "pais\_destino" }  
rename =\> { "srccountry" =\> "pais\_origen" }  
rename =\> { "service" =\> "servico" }  
rename =\> { "sentpkt" =\> "pkt\_enviado" }  
rename =\> { "crscore" =\> "cr\_puntuacion" }  
rename =\> { "craction" =\> "cr\_accion" }  
rename =\> { "crlevel" =\> "cr\_nivel" }  
remove\_field =\> ["dstip", "dstport", "remip", "remport"]  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 22, 2018, 9:06pm UTC](https://discuss.elastic.co/t/code-failure/124939/2 "2018-03-22T21:06:51Z")

</div>

> add\_field =\> [  
> "IP\_destino" =\> "%{remip}"  
> "Puerto\_dest" =\> "%{remport}"  
> ]

Use braces here, not square brackets.

add\_field =\> {  
"IP\_destino" =\> "%{remip}"  
"Puerto\_dest" =\> "%{remport}"  
}

---

<div class="post-metadata">

**Author:** ![PAU\_SUREDA\_COLL](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@PAU\_SUREDA\_COLL](https://discuss.elastic.co/u/PAU_SUREDA_COLL)\
**Post date:** [March 23, 2018, 10:01am UTC](https://discuss.elastic.co/t/code-failure/124939/3 "2018-03-23T10:01:36Z")

</div>

Yes, I fixed it later, now i can see in kibana the logstash logs, but don't add fields  
New code: input {  
file {  
path =\> "C:\entrada"  
start\_position =\> "beginning"  
}  
}

filter {  
grok {  
match =\> ["message", "%{SYSLOG5424PRI:syslog\_index} %{GREEDYDATA:message}"]  
overwrite =\> ["message"]  
tag\_on\_failure =\> ["failure\_grok\_fortigate"]  
}

```
kv{
	source => "message"
	value_split => "="
	field_split => " "
}

if [subtype] == "vpn" {
	if "10.*" in [remip] {
		mutate {
			add_field => {
				"ip_externa" => "%{locip}"
				"puerto_externo" => "%{locport}"
				"ip_interna" => "%{remip}"
				"puerto_interno" => "%{remport}"
				"sentido" => "recibir"
			}
			remove_field => ["locip", "locport", "remip", "remport"]
		}
	} else {
		if "10.*" in [locip] {
			mutate {
				add_field => {
					"ip_externa" => "%{remip}"
					"puerto_externo" => "%{remport}"
					"ip_interna" => "%{locip}"
					"puerto_interno" => "%{locport}"
					"sentido" => "enviar"
				}
				remove_field => ["locip", "locport", "remip", "remport"]
			}
		}
	}
} else { if [subtype] == "local" or "forward" or "webfilter" {
			if "10.*" in [dstip] {
				mutate {
					add_field => {
						"ip_externa" => "%{srcip}"
						"puerto_externo" => "%{srcport}"
						"ip_interna" => "%{dstip}"
						"puerto_interno" => "%{dstport}"
						"sentido" => "recibir"
					}
					remove_field => ["srcip", "srcport", "dstip" , "dstport"]
				}
			} else {
				if "10.*" in [srcip] {
					mutate {
						add_field => {
							"ip_externa" => "%{dstip}"
							"puerto_externo" => "%{dstport}"
							"ip_interna" => "%{srcip}"
							"puerto_interno" => "%{srcport}"
							"sentido" => "enviar"
						}
						remove_field => ["locip", "locport", "remip", "remport"]
					}
				}
			}
		} else { if [subtype] == "system" {
					mutate {
						remove_field => ["srcip", "srcport", "dstip" , "dstport", "locip", "locport", "remip", "remport"]
					}
				} else {}
			}
		}

mutate {
rename => { "time" => "tiempo" }
rename => { "poluuid" => "id_poluu" }
rename => { "catdesc" => "descripcion_cat" }
rename => { "direction" => "direccion" }
rename => { "eventtype" => "tipo_evento" }
rename => { "hostname" => "nombre_host" }
rename => { "method" => "metodo" }
rename => { "profile" => "perfil" }
rename => { "reqtype" => "tipo_peticion" }
rename => { "type" => "tipo" }
rename => { "subtype" => "subtipo" }
rename => { "devname" => "nombre_equipo" }
rename => { "devid" => "id_equipo" }
rename => { "logid" => "id_log" }
rename => { "level" => "nivel" }
rename => { "logdesc" => "descripcion_log" }
rename => { "locport" => "puerto_local" }
rename => { "locip" => "ip_local" }
rename => { "action" => "accion" }
rename => { "user" => "usuario" }
rename => { "group" => "grupo" }
rename => { "xauthuser" => "x_auth_usuario" }
rename => { "xauthgroup" => "x_auth_grupo" }
rename => { "assignip" => "ip_asignada" }
rename => { "vpntunnel" => "tunel_vpn" }
rename => { "status" => "estado" }
rename => { "mode" => "modo" }
rename => { "stage" => "fase" }
rename => { "role" => "rol" }
rename => { "result" => "resultado" }
rename => { "totalsesion" => "sesiones_totales" }
rename => { "bandwidth" => "ancho_banda" }
rename => { "tunnelid" => "tunel_id" }
rename => { "tunneltype" => "tunel_tipo" }
rename => { "tunnelip" => "tunel_ip" }
rename => { "duration" => "duracion" }
rename => { "sentbyte" => "byte_enviado" }
rename => { "rcvdbyte" => "byte_recibido" }
rename => { "srcip" => "ip_origen" }
rename => { "srcport" => "puerto_origen" }
rename => { "dstip" => "ip_destino" }
rename => { "dstport" => "puerto_destino" }
rename => { "remip" => "ip_remota" }
rename => { "destinf" => "informacion_destino" }
rename => { "sessionid" => "id_sesion" }
rename => { "policyid" => "politica_id" }
rename => { "policytype" => "politica_tipo" }
rename => { "dstcountry" => "pais_destino" }
rename => { "srccountry" => "pais_origen" }
rename => { "service" => "servicio" }
rename => { "sentpkt" => "pkt_enviado" }
rename => { "crscore" => "cr_puntuacion" }
rename => { "craction" => "cr_accion" }
rename => { "crlevel" => "cr_nivel" }
remove_field => ["message", "tags"]
}

```

}

output {  
file {  
path =\> "C:\salida"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 24, 2018, 9:28am UTC](https://discuss.elastic.co/t/code-failure/124939/4 "2018-03-24T09:28:37Z")

</div>

So what _do_ you get? Copy/paste from Kibana's JSON tab.

---

<div class="post-metadata">

**Author:** ![PAU\_SUREDA\_COLL](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@PAU\_SUREDA\_COLL](https://discuss.elastic.co/u/PAU_SUREDA_COLL)\
**Post date:** [March 26, 2018, 8:40am UTC](https://discuss.elastic.co/t/code-failure/124939/5 "2018-03-26T08:40:24Z")

</div>

I've fixed the code looking another posts like this:  
[https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2018, 8:40am UTC](https://discuss.elastic.co/t/code-failure/124939/6 "2018-04-23T08:40:26Z")

</div>

Closed on April 23, 2018, 8:40am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.