# Grok Filter

**URL:** <https://discuss.elastic.co/t/grok-filter/352525>\
**Category:** Logstash\
**Created:** [February 5, 2024, 11:14am UTC](https://discuss.elastic.co/t/grok-filter/352525 "2024-02-05T11:14:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Emilie\_Carlier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emilie_carlier/32/131421_2.png) [@Emilie\_Carlier](https://discuss.elastic.co/u/Emilie_Carlier)\
**Post date:** [February 5, 2024, 11:14am UTC](https://discuss.elastic.co/t/grok-filter/352525/1 "2024-02-05T11:14:31Z")

</div>

Hello,  
I have event from Acces Point Dlink.  
I can parse some events but for this type I need your help:

\<6\>1707130951,Src\_MAC="9E:98:48:98:8E:81",Dst\_MAC="EC:AD:E0:7D:5A:98",Src\_IP="10.229.64.250",Dst\_IP="17.57.146.172",Src\_port="59602",Dst\_port="5223",Protocol="TCP",SSID="CCN\_WIFI\_PUBLIC",Auth\_type="",Channel="108",RSSI="-84",User\_ID=""

Could you help me?  
Thanks a lot

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [February 5, 2024, 12:11pm UTC](https://discuss.elastic.co/t/grok-filter/352525/2 "2024-02-05T12:11:46Z")

</div>

> [@Emilie\_Carlier](#):
>
> Hello,  
> I have event from Acces Point Dlink.  
> I can parse some events but for this type I need your help:
> 
> \<6\>1707130951,Src\_MAC="9E:98:48:98:8E:81",Dst\_MAC="EC:AD:E0:7D:5A:98",Src\_IP="10.229.64.250",Dst\_IP="17.57.146.172",Src\_port="59602",Dst\_port="5223",Protocol="TCP",SSID="CCN\_WIFI\_PUBLIC",Auth\_type="",Channel="108",RSSI="-84",User\_ID=""
> 
> Could you help me?  
> Thanks a lot

Hi,

It looks like a comma-separated list of key-value pairs. You can use the `kv` filter in Logstash to parse this. Here's an example of how you might do it:

```auto
filter {
  kv {
    source => "message"
    field_split => ","
    value_split => "="
    trim_key => " "
    trim_value => " "
    remove_char_value => "\""
  }
}

```

Regards

---

<div class="post-metadata">

**Author:** ![Emilie\_Carlier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emilie_carlier/32/131421_2.png) [@Emilie\_Carlier](https://discuss.elastic.co/u/Emilie_Carlier)\
**Post date:** [February 5, 2024, 1:50pm UTC](https://discuss.elastic.co/t/grok-filter/352525/3 "2024-02-05T13:50:59Z")

</div>

Thanks for your feedback.  
If I use this configuration, I only have one line with no spaces in it.  
How can I edit th grok match?  
thanks a lot

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 6, 2024, 10:19pm UTC](https://discuss.elastic.co/t/grok-filter/352525/4 "2024-02-06T22:19:29Z")

</div>

At begging of the line, you have \<6\>1707130951, you can use grok or dissect and then apply KV which yago82 mentioned. Dissect is much easier.

```auto
    dissect {
      mapping => {
        "message" => "<%{procid}>%{sessionid},%{msg}"
      }
    }

```

Change source  
kv {  
source =\> "msg"...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2024, 10:19pm UTC](https://discuss.elastic.co/t/grok-filter/352525/5 "2024-03-05T22:19:47Z")

</div>

Closed on March 5, 2024, 10:19pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.