# Correct parsing Syslog message to json

**URL:** <https://discuss.elastic.co/t/correct-parsing-syslog-message-to-json/326564>\
**Category:** Logstash\
**Created:** [February 27, 2023, 10:29am UTC](https://discuss.elastic.co/t/correct-parsing-syslog-message-to-json/326564 "2023-02-27T10:29:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![poky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/poky/32/116255_2.png) [@poky](https://discuss.elastic.co/u/poky)\
**Post date:** [February 27, 2023, 10:29am UTC](https://discuss.elastic.co/t/correct-parsing-syslog-message-to-json/326564/1 "2023-02-27T10:29:04Z")

</div>

Hi Folks!

I'm trying to parse the following message from mcafee proxy syslog inside my logstash pipeline:

```auto
<30>Feb 24 9:33:45 mwg-n3 mwg-n3: x-message="{"DateTime":"2023-02-22 14:03:44.927","MWG_Source":"mwg-n3.foo.de","MWG_ClientIP":"1.2.3.4","MWG_UserDisplayName":"TESTUSERA","MWG_URLCat":"Content Server","MWG_AppName":"","MWG_URLReputation":"Unverified","MWG_StatusCode":"200","MWG_URLHost":"testhost.com","MWG_URLPath":"/this/isa/a/test/path.img","MWG_URL":"https://testhost.com/this/isa/a/test/path.img?w=56&h=56&q=60&m=6&f=jpg&u=t","MWG_BytesToClient":"2265","MWG_UserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.78","MWG_BlockID":"0","MWG_BlockReason":"","MWG_RequestMethod":"GET","MWG_Antimalware":"","MWG_HeaderReferer":"https://www.somereferrer.com/","MWG_MediaType":"image/jpeg","MWG_AuthDomain":"bmi-net.local","MWG_Cache":"TCP_MISS","MWG_UserNameRAW":"TESTTESTTEST@BMI-NET.LOCAL","MWG_BytesFromServer":"2383","MWG_BytesToServer":"74","MWG_BytesFromClient":"73","MWG_DST_IP":"123.456.789.123"}"

```

I just need all information from the beginning of x-message:

DateTime: 2023-02-22 14:03:44.927  
MWG\_Source: [mwg-n3.foo.de](http://mwg-n3.foo.de)  
...  
...  
until  
MWG\_DST\_IP: 123.456.789.123

How can I do this? I was trying to use Grok but I'm pretty sure that something is wrong in my filters configuration...

```auto
input {
 tcp {
    host => "192.168.1.101"
    port => 1514
  }
}
filter {
 grok {
  match => { "message" => "%{SYSLOGBASE} %{GREEDYDATA:message}" }
  overwrite => ["message"]
 }
 mutate {
  remove_field => ["@timestamp", "@version", "event", "process", "timestamp", "host"]
 }
}
output {
 stdout {}
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 27, 2023, 5:07pm UTC](https://discuss.elastic.co/t/correct-parsing-syslog-message-to-json/326564/2 "2023-02-27T17:07:34Z")

</div>

I suggest using dissect to parse the prefix and then using a json filter to parse the rest. Something similar to [this](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/7) (except that uses kv rather than json).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2023, 5:07pm UTC](https://discuss.elastic.co/t/correct-parsing-syslog-message-to-json/326564/3 "2023-03-27T17:07:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.