[] [1:1000039:0] updatelocation - Alert [] [Priority: 0] 02/27-14:29:46.412090 0A:01:01:01:01:01 -> 0A:02:02:02:02:02 type:0x800 len:0xC6 10.1.1.1 -> 10.2.2.2 SCTP TTL:255 TOS:0x0 ID:4660 IpLen:20 DgmLen:184 This is my log snort log file content, Please help me write the grok filter for logtsas…

[image] Ganesh2303: 12.12.12.12 -> 11.11.11.11 SCTP TTL:255 TOS:0x0 ID:4660 IpLen:20 DgmLen:148 Try this grok pattern, %{IP:Source} -> %{IP:Destination} %{WORD:Protocol}

Discuss the Elastic Stack

Grok Filter For my Log file

Elastic Stack Logstash

Ganesh2303 (Ganesh) March 1, 2019, 8:42am 9

Try this grok pattern,

%{IP:Source} -> %{IP:Destination} %{WORD:Protocol}

Topic		Replies	Views
Logstash Snort Log Parse Error Logstash	3	558	October 26, 2018
Loading snort alerts into logstash (GROK PATTERN) Logstash	1	937	November 13, 2019
Grok pattern for snort alerts Logstash	5	1161	July 7, 2022
Parse snort los Logstash	2	854	June 28, 2018
Help parse Snort IDS Alert Logstash	3	953	December 28, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Grok Filter For my Log file

Related topics