# GROK filter for different events sourced fro the same input

**URL:** <https://discuss.elastic.co/t/grok-filter-for-different-events-sourced-fro-the-same-input/83485>\
**Category:** Logstash\
**Created:** [April 25, 2017, 3:39am UTC](https://discuss.elastic.co/t/grok-filter-for-different-events-sourced-fro-the-same-input/83485 "2017-04-25T03:39:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![evlonden](https://avatars.discourse-cdn.com/v4/letter/e/3d9bf3/32.png) [@evlonden](https://discuss.elastic.co/u/evlonden)\
**Post date:** [April 25, 2017, 3:39am UTC](https://discuss.elastic.co/t/grok-filter-for-different-events-sourced-fro-the-same-input/83485/1 "2017-04-25T03:39:20Z")

</div>

Hi All,

I'm puzzling a bit with some filter settings whereby events being sourced from a UDP input in (not really) syslog format have somewhat different characteristics. Based upon the event class generated by the Brocade switches you might seen different sections in the event lines.

As an example a normal raslog event message may show up like this:

("@timestamp":"2017-04-24T05:54:34.917Z","syslog\_hostname":"Sydney\_ILAB\_7k81","@version":"1","host":"10.129.2.128","message":"\<148\>Apr 24 05:44:37 Sydney\_ILAB\_7k81 **raslogd: 2017/04/24-05:44:37** , [KSWD-1002], 363869, FFDC | WWN 10:00:00:05:33:27:de:f4 | CHASSIS, WARNING, Brocade7800, Detected termination of process 0.weblinker.fcg:22479.\n","type":"syslog","syslog\_message":"raslogd: 2017/04/24-05:44:37, [KSWD-1002], 363869, FFDC | WWN 10:00:00:05:33:27:de:f4 | CHASSIS, WARNING, Brocade7800, Detected termination of process 0.weblinker.fcg:22479.\n","syslog\_pri":"148"}

Take a special view in the message after "raslog:" (I highlighted it in Bold)

When a certain event falls under an auditable class it changes to this:

{"@timestamp":"2017-04-24T05:54:34.981Z","syslog\_hostname":"Sydney\_ILAB\_7k81","@version":"1","host":"10.129.2.128","message":"\<150\>Apr 24 05:44:37 Sydney\_ILAB\_7k81 raslogd: AUDIT, 2017/04/24-05:44:37 (GMT), [HAM-1015], INFO, RAS, NONE/root/NONE/None/CLI, ad\_0/Brocade7800/CHASSIS, 7.4.1e, , , , , , , Software Component weblinker (pid:22479) restarted.\n","type":"syslog","syslog\_message":"**raslogd: AUDIT, 2017/04/24-05:44:37 (GMT)**, [HAM-1015], INFO, RAS, NONE/root/NONE/None/CLI, ad\_0/Brocade7800/CHASSIS, 7.4.1e, , , , , , , Software Component weblinker (pid:22479) restarted.\n","syslog\_pri":"150"}

I'm not sure if this is solvable in GROK although when it is I would like some help thinking this over via regex's of some sort.

Anyone have any idea?

Thanks  
Erwin

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 25, 2017, 6:10am UTC](https://discuss.elastic.co/t/grok-filter-for-different-events-sourced-fro-the-same-input/83485/2 "2017-04-25T06:10:41Z")

</div>

A grok filter can include multiple expressions that are tried in order. I think there's an example in the documentation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2017, 6:13am UTC](https://discuss.elastic.co/t/grok-filter-for-different-events-sourced-fro-the-same-input/83485/3 "2017-05-23T06:13:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.