# Grok help splitting username:ip properly

**URL:** <https://discuss.elastic.co/t/grok-help-splitting-username-ip-properly/132859>\
**Category:** Logstash\
**Created:** [May 22, 2018, 5:12pm UTC](https://discuss.elastic.co/t/grok-help-splitting-username-ip-properly/132859 "2018-05-22T17:12:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sm00thindian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sm00thindian/32/27376_2.png) [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)\
**Post date:** [May 22, 2018, 5:12pm UTC](https://discuss.elastic.co/t/grok-help-splitting-username-ip-properly/132859/1 "2018-05-22T17:12:40Z")

</div>

I have log lines like the following:

```
2018-05-19 17:59:42 - Nagios XI [16] a1abc10:192.168.0.10 - User authenticated via Rapid Response
2018-05-20 00:00:03 - Nagios XI [32] system:localhost - User submitted a command to the subsystem (ID=1117)

```

My current Grok filter is:  
`^%{TIMESTAMP_ISO8601:timestamp} - *%{DATA:app_name} %{DATA:app_version} *%{NAGIOSTIME:nagios_epoch} *%{DATA:username_ip} - %{GREEDYDATA:message}$`

The output is:  
{  
"timestamp": [  
[  
"2018-05-19 17:59:42"  
]  
],  
"YEAR": [  
[  
"2018"  
]  
],  
"MONTHNUM": [  
[  
"05"  
]  
],  
"MONTHDAY": [  
[  
"19"  
]  
],  
"HOUR": [  
[  
"17",  
null  
]  
],  
"MINUTE": [  
[  
"59",  
null  
]  
],  
"SECOND": [  
[  
"42"  
]  
],  
"ISO8601\_TIMEZONE": [  
[  
null  
]  
],  
"app\_name": [  
[  
"Nagios"  
]  
],  
"app\_version": [  
[  
"XI"  
]  
],  
"nagios\_epoch": [  
[  
"[16]"  
],  
[  
"16"  
]  
],  
"BASE10NUM": [  
[  
"16"  
]  
],  
"username\_ip": [  
[  
"a1abc10:192.168.0.10"  
]  
],  
"message": [  
[  
"User authenticated via Rapid Response"  
]  
]  
}

Ideally I'd like to have the username\_ip split into two different fields userid and source\_ip. Now as you can see the second line has "system:localhost" for the same data point ... so I need to account for that and I'm way past my Grok uberness at this point.

---

<div class="post-metadata">

**Author:** ![sm00thindian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sm00thindian/32/27376_2.png) [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)\
**Post date:** [May 22, 2018, 6:45pm UTC](https://discuss.elastic.co/t/grok-help-splitting-username-ip-properly/132859/2 "2018-05-22T18:45:34Z")

</div>

Alright, figured this one out, thanks for looking.  
%{TIMESTAMP\_ISO8601:timestamp} - \*%{DATA:app\_name} %{DATA:app\_version} \*%{NAGIOSTIME:nagios\_epoch} \*%{WORD:userID}:%{IP} -  
\*%{GREEDYDATA:message}

Did the trick

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2018, 6:45pm UTC](https://discuss.elastic.co/t/grok-help-splitting-username-ip-properly/132859/3 "2018-06-19T18:45:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.