# GROK Filter problems

**URL:** https://discuss.elastic.co/t/grok-filter-problems/132650
**Category:** Logstash
**Created:** [May 21, 2018, 11:47am UTC](https://discuss.elastic.co/t/grok-filter-problems/132650 "2018-05-21T11:47:50Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![TheOnlyOne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theonlyone/32/31400_2.png) [@TheOnlyOne](https://discuss.elastic.co/u/TheOnlyOne)
#### Post date: [May 21, 2018, 11:47am UTC](https://discuss.elastic.co/t/grok-filter-problems/132650/1 "2018-05-21T11:47:50Z")

</div>

Hello,  
im new on logstash. i use the grok debugger to get extra fields for logstash

This is my log:  
\<14\>May 21 11:01:46 SERVERNAME01 gravityzone: [aph] {"computer\_name":"PC1","computer\_fqdn":"[PC1.company.com](http://PC1.company.com)","computer\_ip":"10.0.0.1","computer\_id":"586cfb67383c7983368b456a","product\_installed":"BEST","user":{"id":"S-1-5-18","name":"SYSTEM"},"aph\_type":"phishing","url":"https:\/\/xxx.com\/","status":"aph\_blocked","last\_blocked":"2018-05-21T11:01:43.000Z","count":1,"module":"aph"}",

At the moment i have the following pattern:  
%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{WORD:PRODUKTNAME]}

i hang on [AHP], i dont now why ☹

Can anybody help me?

thanks!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 21, 2018, 1:51pm UTC](https://discuss.elastic.co/t/grok-filter-problems/132650/2 "2018-05-21T13:51:24Z")

</div>

> [@TheOnlyOne](#):
>
> %{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{WORD:PRODUKTNAME]}

I am surprised that works with that random ] at the end of PRODUKTNAME, but it does. Anyways, this will parse that...

```
  grok { match => ["message", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{WORD:PRODUKTNAME}: \[%{WORD}\] %{GREEDYDATA:[@metadata][someJSON]}" ] }
  json { source => "[@metadata][someJSON]" target => "somewhere"}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 18, 2018, 1:51pm UTC](https://discuss.elastic.co/t/grok-filter-problems/132650/3 "2018-06-18T13:51:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.