# Grok filter for parsing SSL ciphers?

**URL:** <https://discuss.elastic.co/t/grok-filter-for-parsing-ssl-ciphers/123266>\
**Category:** Logstash\
**Created:** [March 9, 2018, 1:14pm UTC](https://discuss.elastic.co/t/grok-filter-for-parsing-ssl-ciphers/123266 "2018-03-09T13:14:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![burnersk](https://avatars.discourse-cdn.com/v4/letter/b/e79b87/32.png) [@burnersk](https://discuss.elastic.co/u/burnersk)\
**Post date:** [March 9, 2018, 1:14pm UTC](https://discuss.elastic.co/t/grok-filter-for-parsing-ssl-ciphers/123266/1 "2018-03-09T13:14:01Z")

</div>

Has anyone already created a Grok filter for extracting key exchange, encryption, signature and integrity information out of the OpenSSL cipher?

For example, I have the following raw information "ECDHE-RSA-CHACHA20-POLY1305" within the field "ssl\_cipher".

This breaks down into:

- "ssl\_cipher\_exchange" =\> "ECDHE"
- "ssl\_cipher\_signature" =\> "RSA"
- "ssl\_cipher\_encryption" =\> "CHACHA20""
- "ssl\_cipher\_mac" =\> "POLY1305"

This could be a no-brainer, however it is not that simple. Have a look at the [possible raw cipher information from the OpenSSL documentation (2nd column)](https://www.openssl.org/docs/man1.0.2/apps/ciphers.html#CIPHER-SUITE-NAMES).

You will see, that there are much more "formats" for the raw information than the above mentioned example.

For example we also may have:

- EXP-RC4-MD5
- RC4-MD5
- EXP-ADH-RC4-MD5
- EXP-EDH-DSS-DES-CBC-SHA
- DHE-DSS-SEED-SHA

The only solution I came up with was text matching instead of pattern matching. So I am matching for e.g. "ECDHE" and add the field manually.

Has anyone came up with a solution using Grok pattern matches instead of text matches?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2018, 1:14pm UTC](https://discuss.elastic.co/t/grok-filter-for-parsing-ssl-ciphers/123266/2 "2018-04-06T13:14:13Z")

</div>

Closed on April 6, 2018, 1:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.