# Grok help needed
**URL:** https://discuss.elastic.co/t/grok-help-needed/304102
**Category:** Logstash
**Created:** [May 6, 2022, 8:02am UTC](https://discuss.elastic.co/t/grok-help-needed/304102 "2022-05-06T08:02:35Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@sdevasy73](https://discuss.elastic.co/u/sdevasy73)
#### Post date: [May 6, 2022, 8:02am UTC](https://discuss.elastic.co/t/grok-help-needed/304102/1 "2022-05-06T08:02:36Z")
i am a newbie to grok pattern, trying to parse the below mentioned cisco firewall syslog.
With the try struggling with what type to use to extract the interested fields, some of them works if i paste it individually, but combined it gives compile error in grox debugger.
need some help , thanks!
```auto
sample
------
May 05 2022 20:25:51 %FTD-1-400006: EventPriority: Low, DeviceUUID: cd5405c4-cea2-13eb-94ea-bdzc1md93886, InstanceID: 2, FirstPacketSecond: 2022-05-05T20:25:51Z, ConnectionID: 50568, AccessControlRuleAction: Allow, SrcIP: 178.189.7.12, DstIP: 192.16.1.31, SrcPort: 54022, DstPort: 443, Protocol: tcp, IngressInterface: CAG, EgressInterface: LAN, IngressZone: CAG, EgressZone: LAN, IngressVRF: Global, EgressVRF: Global, ACPolicy: Access Control Policy, AccessControlRuleName: 00000000-0000-0168-0700-c0eae4ec0b4a, Prefilter Policy: Default Prefilter Policy, Client: SSL client, ApplicationProtocol: HTTPS, WebApplication: Invalid ID, ConnectionDuration: 0, InitiatorPackets: 8, ResponderPackets: 8, InitiatorBytes: 443, ResponderBytes: 5584, NAPPolicy: Balanced Security and Connectivity, URLReputation: Unknown, URL: https://wawa.us.net
```
```auto
%{SYSLOGTIMESTAMP:timestamp}, AccessControlRuleAction: %{WORD:ac_action}, AccessControlRuleName: %{DATA:ac_rule_name}, SrcIP: %{IP:src_addr}, DstIP: %{IP:dst_addr}, IngressZone: %{HOSTNAME:ingress_zone}, EgressZone: %{HOSTNAME:egress_zone}, ApplicationProtocol: %{WORD:proto}, URL: %{URIPATH:url}
```
---
### Author:  [@ibra\_013](https://discuss.elastic.co/u/ibra_013)
#### Post date: [May 6, 2022, 11:08am UTC](https://discuss.elastic.co/t/grok-help-needed/304102/2 "2022-05-06T11:08:54Z")
Hi,
for your example and what is showing, a [dissect](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) and [key-value pairs filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) is suitable for you.
---
### Author:  [@sdevasy73](https://discuss.elastic.co/u/sdevasy73)
#### Post date: [May 6, 2022, 11:33am UTC](https://discuss.elastic.co/t/grok-help-needed/304102/3 "2022-05-06T11:33:54Z")
Thanks for your reply Ibra13.
Let me search about how to move around with dissect and key-value pair filter. Feel free to suggest some if you happen to have a link. Thanks!
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [May 6, 2022, 11:53am UTC](https://discuss.elastic.co/t/grok-help-needed/304102/4 "2022-05-06T11:53:29Z")
```auto
input {
generator {
lines => ["May 05 2022 20:25:51 %FTD-1-400006: EventPriority: Low, DeviceUUID: cd5405c4-cea2-13eb-94ea-bdzc1md93886, InstanceID: 2, FirstPacketSecond: 2022-05-05T20:25:51Z, ConnectionID: 50568, AccessControlRuleAction: Allow, SrcIP: 178.189.7.12, DstIP: 192.16.1.31, SrcPort: 54022, DstPort: 443, Protocol: tcp, IngressInterface: CAG, EgressInterface: LAN, IngressZone: CAG, EgressZone: LAN, IngressVRF: Global, EgressVRF: Global, ACPolicy: Access Control Policy, AccessControlRuleName: 00000000-0000-0168-0700-c0eae4ec0b4a, Prefilter Policy: Default Prefilter Policy, Client: SSL client, ApplicationProtocol: HTTPS, WebApplication: Invalid ID, ConnectionDuration: 0, InitiatorPackets: 8, ResponderPackets: 8, InitiatorBytes: 443, ResponderBytes: 5584, NAPPolicy: Balanced Security and Connectivity, URLReputation: Unknown, URL: https://wawa.us.net"]
count => 1
}
}
filter {
dissect {
mapping => { "message" => "%{ts} %{+ts} %{+ts} %{+ts} %{changename}: %{msg}" }
}
kv {
source => "msg"
value_split => ": "
field_split => ", "
}
mutate {
strip => ["changename"]
}
}
output {
stdout { codec => "json_lines" }
}
```
---
### Author:  [@sdevasy73](https://discuss.elastic.co/u/sdevasy73)
#### Post date: [May 6, 2022, 2:16pm UTC](https://discuss.elastic.co/t/grok-help-needed/304102/5 "2022-05-06T14:16:16Z")
Loads of thanks aaron-nimocks for your effort to code it, appreciate it throughly.
Somehow giving error while importing it into graylog json extractor which say's 'No definition for key 'ts' found, aborting'
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [May 6, 2022, 2:23pm UTC](https://discuss.elastic.co/t/grok-help-needed/304102/6 "2022-05-06T14:23:09Z")
Would need to see your Logstash configuration to assist further.
---
### Author:  [@sdevasy73](https://discuss.elastic.co/u/sdevasy73)
#### Post date: [May 6, 2022, 3:53pm UTC](https://discuss.elastic.co/t/grok-help-needed/304102/7 "2022-05-06T15:53:16Z")
Hi Aaron, i did not do anything with Logstash config while setting up graylog (admist exploring few days ago). I see it can import grok pattern as json format to parse the input of cisco logs (Raw/Plaintext UDP)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 3, 2022, 3:53pm UTC](https://discuss.elastic.co/t/grok-help-needed/304102/8 "2022-06-03T15:53:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.