Grok Filter For my Log file

Elastic Stack Logstash
1

[] [1:1000039:0] updatelocation - Alert []
[Priority: 0]
02/27-14:29:46.412090 0A:01:01:01:01:01 -> 0A:02:02:02:02:02 type:0x800 len:0xC6
10.1.1.1 -> 10.2.2.2 SCTP TTL:255 TOS:0x0 ID:4660 IpLen:20 DgmLen:184

This is my log snort log file content, Please help me write the grok filter for logtsash
Thankyou in Adv, I tried myself but no luck

2

Sharing what you have tried would be useful :slight_smile:

3

I am using Logstash 6.6.0, and I am newbie to grok Filters..

input {
beats{
port => 5044
}
}
filter {
if [type] == "snort" {
grok {
patterns_dir => ["misc.patterns"]
match => { "message" => "%{<?[?]:bracket} %{<?1:00:0?>:duration}" }
}
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}

4

can you place your log with prefromatted text so it will be helpful and explain do you have any recommended fields to store the value

5

These are Snort Logs with no exact format, or predefined format.

these are four repetitive lines

[] [1:1000089:0] notifySS - Alert []
[Priority: 0]
01/15-11:32:33.917427 0A:01:01:01:01:01 -> 0A:02:02:02:02:02 type:0x800 len:0xA2
12.12.12.12 -> 11.11.11.11 SCTP TTL:255 TOS:0x0 ID:4660 IpLen:20 DgmLen:148

6

In this 4 lines what all value you need to capture

7

Source IP, Destination IP and Protocol
12.12.12.12 -> 11.11.11.11 SCTP

8

i want to one more thing above message which you have mentioned each line is new line or multiple line message

9

Try this grok pattern,

%{IP:Source} -> %{IP:Destination} %{WORD:Protocol}

10

Thankyou Ganesh its working, Please tell me how to parse the first two lines in the logs as well, Each line is a new line and also log pattern repeats every every fourth line

first two lines
[ ] [1:1000089:0] notifySS - Alert [ ]
[Priority: 0]

11

If you dont want to index those value mean you can ignore the line before it get indexed

12

Thankyou Ganesh :slight_smile:

13

You welcome.. If your issue resolved mark the resolved solution

14

Please tell me how to add the parsed into separate fields?

15

I have done that :slight_smile: Thankyou

16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.