Grok Filter For my Log file

[] [1:1000039:0] updatelocation - Alert []
[Priority: 0]
02/27-14:29:46.412090 0A:01:01:01:01:01 -> 0A:02:02:02:02:02 type:0x800 len:0xC6 -> SCTP TTL:255 TOS:0x0 ID:4660 IpLen:20 DgmLen:184

This is my log snort log file content, Please help me write the grok filter for logtsash
Thankyou in Adv, I tried myself but no luck

Sharing what you have tried would be useful :slight_smile:

I am using Logstash 6.6.0, and I am newbie to grok Filters..

input {
port => 5044
filter {
if [type] == "snort" {
grok {
patterns_dir => ["misc.patterns"]
match => { "message" => "%{<?[?]:bracket} %{<?1:00:0?>:duration}" }
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }

can you place your log with prefromatted text so it will be helpful and explain do you have any recommended fields to store the value

These are Snort Logs with no exact format, or predefined format.

these are four repetitive lines

[] [1:1000089:0] notifySS - Alert []
[Priority: 0]
01/15-11:32:33.917427 0A:01:01:01:01:01 -> 0A:02:02:02:02:02 type:0x800 len:0xA2 -> SCTP TTL:255 TOS:0x0 ID:4660 IpLen:20 DgmLen:148

In this 4 lines what all value you need to capture

Source IP, Destination IP and Protocol -> SCTP

i want to one more thing above message which you have mentioned each line is new line or multiple line message

Try this grok pattern,

%{IP:Source} -> %{IP:Destination} %{WORD:Protocol}

Thankyou Ganesh its working, Please tell me how to parse the first two lines in the logs as well, Each line is a new line and also log pattern repeats every every fourth line

first two lines
[ ] [1:1000089:0] notifySS - Alert [ ]
[Priority: 0]

If you dont want to index those value mean you can ignore the line before it get indexed

Thankyou Ganesh :slight_smile:

You welcome.. If your issue resolved mark the resolved solution

Please tell me how to add the parsed into separate fields?

I have done that :slight_smile: Thankyou

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.