# Elk snort

**URL:** <https://discuss.elastic.co/t/elk-snort/149353>\
**Category:** Logstash\
**Created:** [September 20, 2018, 8:17pm UTC](https://discuss.elastic.co/t/elk-snort/149353 "2018-09-20T20:17:51Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pirate\_Trkmn](https://avatars.discourse-cdn.com/v4/letter/p/977dab/32.png) [@Pirate\_Trkmn](https://discuss.elastic.co/u/Pirate_Trkmn)\
**Post date:** [September 20, 2018, 8:17pm UTC](https://discuss.elastic.co/t/elk-snort/149353/1 "2018-09-20T20:17:51Z")

</div>

Hi i am configuring logstash for snort logs following few tutorials from web, but can not parse snort logs i have  
[%{INT:ids\_gid}:%{INT:ids\_sid}:%{INT:ids\_rev}].%{GREEDYDATA:ids\_alert}.[Classification: %{DATA:ids\_classification}]._[Priority: %{INT:ids\_priority}]._{%{WORD:ids\_proto}}._%{IP:src\_ip}:%{INT:src\_port} -\>._%{IP:dst\_ip}:%{INT:dst\_port}

and tested it from console it is parsing logs, but when i implement it on filter is not working.

For example i have:

filter {  
if "PFSense" in [tags] {  
mutate {  
add\_tag =\> ["firewall"]  
}

but If is not recognizing PFSense from logs?????

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2018, 8:21pm UTC](https://discuss.elastic.co/t/elk-snort/149353/2 "2018-09-20T20:21:02Z")

</div>

It's impossible to help without knowing what the logs look like. Please also post your full configuration and format it as preformatted text using Markdown notation or the `</>` toolbar button.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 21, 2018, 6:21am UTC](https://discuss.elastic.co/t/elk-snort/149353/4 "2018-09-21T06:21:07Z")

</div>

And exactly what isn't working? The first grok appears to work since you're getting the `prog` field.

---

<div class="post-metadata">

**Author:** ![Pirate\_Trkmn](https://avatars.discourse-cdn.com/v4/letter/p/977dab/32.png) [@Pirate\_Trkmn](https://discuss.elastic.co/u/Pirate_Trkmn)\
**Post date:** [September 21, 2018, 6:58am UTC](https://discuss.elastic.co/t/elk-snort/149353/5 "2018-09-21T06:58:54Z")

</div>

There is snort parsing grok also it is not working. And i have :  
filter {  
if "PFSense" in [tags] {  
mutate {  
add\_tag =\> ["firewall"]  
} tag firewall is not adding

---

<div class="post-metadata">

**Author:** ![Pirate\_Trkmn](https://avatars.discourse-cdn.com/v4/letter/p/977dab/32.png) [@Pirate\_Trkmn](https://discuss.elastic.co/u/Pirate_Trkmn)\
**Post date:** [September 21, 2018, 7:00am UTC](https://discuss.elastic.co/t/elk-snort/149353/6 "2018-09-21T07:00:43Z")

</div>

there is not any error in /var/log/logstash it shows working properly.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 21, 2018, 7:08am UTC](https://discuss.elastic.co/t/elk-snort/149353/7 "2018-09-21T07:08:16Z")

</div>

> There is snort parsing grok also it is not working.

That's because you require the `prog` field to contain "snort", but it actually contains "snort[123]".

> tag firewall is not adding

Both messages in your screenshot have a firewall tag.

---

<div class="post-metadata">

**Author:** ![Pirate\_Trkmn](https://avatars.discourse-cdn.com/v4/letter/p/977dab/32.png) [@Pirate\_Trkmn](https://discuss.elastic.co/u/Pirate_Trkmn)\
**Post date:** [September 21, 2018, 7:24am UTC](https://discuss.elastic.co/t/elk-snort/149353/8 "2018-09-21T07:24:57Z")

</div>

yes there is firewall tag here whenever i changed firewall tag to something else for example i changed it to test it is not adding, it adding again firewall there

---

<div class="post-metadata">

**Author:** ![Pirate\_Trkmn](https://avatars.discourse-cdn.com/v4/letter/p/977dab/32.png) [@Pirate\_Trkmn](https://discuss.elastic.co/u/Pirate_Trkmn)\
**Post date:** [September 21, 2018, 7:28am UTC](https://discuss.elastic.co/t/elk-snort/149353/9 "2018-09-21T07:28:18Z")

</div>

filter {  
if "PFSense" in [tags] {  
mutate {  
add\_tag =\> ["test"]  
}  
}  
}  
i added test to check is it working or not i and it is not adding test tag, there is PFSense tag in tags i am sure.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2018, 7:28am UTC](https://discuss.elastic.co/t/elk-snort/149353/10 "2018-10-19T07:28:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.