# Grok Filtering - Two Groks One Feed **URL:** \ **Category:** Logstash\ **Created:** [January 17, 2018, 3:45pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915 "2018-01-17T15:45:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Stormdizzle](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@Stormdizzle](https://discuss.elastic.co/u/Stormdizzle)\ **Post date:** [January 17, 2018, 3:45pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915/1 "2018-01-17T15:45:37Z")
I am trying to figure out how to make the Grok filtering work properly, but it appears that I am not having such luck. I looked at other documents but I can't seem to figure it out so hopefully someone smarter than me can assist me. I have a Syslog feed coming from Panorama. Some of the feed messages are different than others. I wanted to filter on two things. One of them is the threat feeds and the other is from the honeypot feeds. Both are coming from the same source but I can't seem to filter it properly. The one for doing the threat feed works if used by itself. Thoughts? The pictures are the two file examples that I am trying to parse. ![THREAT](https://us1.discourse-cdn.com/elastic/original/3X/2/1/219d827be8404bdd086af9d46ce025eba1c55e70.PNG) ![HONEYPOT](https://us1.discourse-cdn.com/elastic/original/3X/e/7/e78b7f13e01edae7033d10f652e338b092886704.PNG) This is my current Grok filter. input { syslog { port =\> 5900 add\_field =\> { "source" =\> "panorama" "sensor" =\> "panorama" "sensor\_type" =\> "internet" } } } filter { if [source] == "panorama" { grok { match =\> { "message" =\> "%{DATA:future\_use\_1},%{DATESTAMP:receive\_time},%{NUMBER:serial\_number},%{SPACE}(?.\*),%{WORD:subtype},%{DATA:future\_use\_2},%{DATESTAMP:generated\_time},%{IP:source\_ip},%{IP:destination\_ip},%{IP:nat\_source\_ip},%{IP:nat\_destination\_ip},%{DATA:rule\_name},%{DATA:source\_user},%{DATA:destination\_user},%{DATA:application},%{DATA:virtual\_system},%{DATA:source\_zone},%{DATA:destination\_zone},%{DATA:ingress\_interface},%{DATA:egress\_interface},%{DATA:log\_forwarding\_profile},%{DATA:future\_use\_3},%{NUMBER:session\_id},%{INT:repeat\_count},%{INT:source\_port},%{INT:destination\_port},%{INT:nat\_source\_port},%{INT:nat\_destination\_port},%{BASE16NUM:flags},%{DATA:protocol},%{DATA:action},%{QUOTEDSTRING:miscellaneous},%{DATA:threat\_id},%{DATA:category},%{WORD:severity},%{DATA:direction},%{INT:sequence\_number},%{BASE16NUM:action\_flags},%{DATA:source\_location},%{DATA:destination\_location},%{DATA:future\_use\_4},%{DATA:content\_type},%{INT:pcap\_id},%{DATA:filedigest},%{DATA:cloud},%{DATA:future\_use\_5},"} add\_field =\> { "type" =\> "threatalert" } } grok { match =\> { "message" =\> "%{DATA:future\_use\_1},%{DATA:average\_severity},%{DATA:severity},%{NUMBER:normalized\_id},%{DATA:normalized\_rule},%{DATA:signature\_name},%{DATA:signature\_id},%{DATA:rule\_message},%{DATA:rule\_id},%{DATA:event\_subtype},%{NUMBER:event\_id},%{NUMBER:event\_count},%{DATA:source\_user},%{IP:source\_ip},%{INT:source\_port},%{DATA:source\_zone},%{DATA:geolocation\_source},%{DATA:destination\_user},%{IP:destination\_ip},%{INT:destination\_port},%{SPACE}(?.\*),%{DATA:geolocation\_destination},%{DATA:session\_id},%{DATA:application},%{DATA:file\_detail},%{DATA:category},%{DATA:interface},%{DATA:url},%{DATESTAMP:last\_time},%{DATA:future\_use\_1},%{DATA:future\_use\_2},"} add\_field =\> { "type" =\> "honeypot" } } ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [January 17, 2018, 8:17pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915/2 "2018-01-17T20:17:40Z")
Try using another than "type" for your field. "type" is used in elasticsearch too and you can't have two types in one index since version 6.x ---
**Author:** ![Stormdizzle](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@Stormdizzle](https://discuss.elastic.co/u/Stormdizzle)\ **Post date:** [January 17, 2018, 8:30pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915/3 "2018-01-17T20:30:13Z")
Thanks for the reply. I just saw on another post that someone had that and it worked for them so I guess I am confused. Do you have any suggestions or something I could try as an example? ---
**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\ **Post date:** [January 17, 2018, 8:34pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915/4 "2018-01-17T20:34:50Z")
Try naming the field "logtype" for example instead of "type". Like so: ``` add_field => { "logtype" => "threatalert" } ``` and ``` add_field => { "logtype" => "honeypot" } ``` ---
**Author:** ![Stormdizzle](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@Stormdizzle](https://discuss.elastic.co/u/Stormdizzle)\ **Post date:** [January 17, 2018, 8:36pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915/5 "2018-01-17T20:36:31Z")
Okay great. I made the change. I will see how it works. 🙂 ---
**Author:** ![Stormdizzle](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@Stormdizzle](https://discuss.elastic.co/u/Stormdizzle)\ **Post date:** [January 18, 2018, 1:59pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915/6 "2018-01-18T13:59:02Z")
Well...that didn't work so my Grok filter must be wrong then. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 15, 2018, 1:59pm UTC](https://discuss.elastic.co/t/grok-filtering-two-groks-one-feed/115915/7 "2018-02-15T13:59:10Z")
Closed on February 15, 2018, 1:59pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.