# Grok Filter Error

**URL:** <https://discuss.elastic.co/t/grok-filter-error/120518>\
**Category:** Logstash\
**Created:** [February 19, 2018, 7:29pm UTC](https://discuss.elastic.co/t/grok-filter-error/120518 "2018-02-19T19:29:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MrThecrackerx](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@MrThecrackerx](https://discuss.elastic.co/u/MrThecrackerx)\
**Post date:** [February 19, 2018, 7:29pm UTC](https://discuss.elastic.co/t/grok-filter-error/120518/1 "2018-02-19T19:29:26Z")

</div>

Hi

I am a bit newbie here but i am trying to parse one of the syslog message IDs for cisco ASA.

> **[Cisco ASA Series Syslog Messages - Syslog Messages
	 602101 to 622102 \[Cisco...](https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs6.html#con_4774514)**
>
> Cisco ASA Series Syslog Messages 
> -Syslog Messages
> 602101 to 622102

the syslog message id is 609001

```
input {
        stdin {}
 }

filter {
        grok {
                match => ["message", "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{IP:hosts}%{SPACE}:%{CISCOTIMESTAMP}%{SPACE}UTC:%{SPACE}%ASA-session-7-609001: Built local-host %{HOSTNAME:complex}:%{IP:src_ip}"]
        }

output {
  stdout { }
}

```

Sample logs are

```
 2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:03 UTC: %ASA-session-7-609001: Built local-host INSIDE-CGO-IP:10.23.49.157
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:03 UTC: %ASA-session-7-609001: Built local-host INSIDE-CGO-IP:10.23.49.63
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:04 UTC: %ASA-session-7-609001: Built local-host INSIDE-DPPQS:10.23.89.27
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:03 UTC: %ASA-session-7-609001: Built local-host INSIDE-CGO-IP:10.23.49.202
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:03 UTC: %ASA-session-7-609001: Built local-host INSIDE-CGO-IP:10.23.49.171
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:04 UTC: %ASA-session-7-609001: Built local-host INSIDE-DPPQS:10.23.89.27
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:03 UTC: %ASA-session-7-609001: Built local-host INSIDE-CGO-IP:10.23.49.145
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:03 UTC: %ASA-session-7-609001: Built local-host INSIDE-CGO-IP:10.23.49.193
2018-02-08T13:00:02+05:30 10.199.197.130 :Feb 08 07:30:03 UTC: %ASA-session-7-609001: Built local-host INSIDE-CGO-IP:10.23.49.89

```

Edit 1: Damn my mistake figured it out left out a "}"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2018, 7:29pm UTC](https://discuss.elastic.co/t/grok-filter-error/120518/2 "2018-03-19T19:29:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.