# Grok is succesfull in various debuggers but fails in practice with specific keyword **URL:** \ **Category:** Logstash\ **Created:** [July 16, 2018, 9:08am UTC](https://discuss.elastic.co/t/grok-is-succesfull-in-various-debuggers-but-fails-in-practice-with-specific-keyword/140112 "2018-07-16T09:08:00Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Post date:** [July 16, 2018, 9:08am UTC](https://discuss.elastic.co/t/grok-is-succesfull-in-various-debuggers-but-fails-in-practice-with-specific-keyword/140112/1 "2018-07-16T09:08:01Z")
Hi, I have the following logstash config which parses syslog messages: ``` filter { if "syslog" in [tags] and "pre-processed" not in [tags] { if "%ASA-" in [message] { mutate { gsub => [ "message", "<166>", "", "message", "<164>", "", "message", "<163>", "", "message", "<162>", "" ] add_tag => ["pre-processed", "Firewall", "ASA", "log01"] } grok { match => [ "message", "^%{CISCOTIMESTAMP:localtime}:.%%{CISCOTAG:ciscotag}:.%{CISCO_ACTION:action}.%{WORD}.%{WORD}.%{WORD}.%{WORD}.%{WORD}:%{IPORHOST}/%{NUMBER}.%{WORD}.%{WORD}:%{IPORHOST:dst_ip}/%{NUMBER:dst_port}$", "message", "^%{CISCOTIMESTAMP:localtime}.%{IPORHOST:host}.%%{CISCOTAG:ciscotag}: SFR requested ASA to %{WORD:action} further packet redirection and process %{WORD:protocol} flow from %{IPORHOST:src_interface}:%{IPORHOST:src_ip}/%{NUMBER:src_port} to %{IPORHOST:dst_interface}:%{IPORHOST:dst_ip}/%{NUMBER:dst_port} %{GREEDYDATA:cisco_message}$", "message", "^%{CISCOTIMESTAMP:localtime}.%{IPORHOST:host}.%%{CISCOTAG:ciscotag}: SFR requested to %{WORD:action} %{WORD:protocol} packet from %{IPORHOST:src_interface}:%{IPORHOST:src_ip}/%{NUMBER:src_port}$", "message", "^%{CISCOTIMESTAMP:localtime}:.%%{CISCOTAG:ciscotag}:.%{GREEDYDATA:cisco_message}$" ] } syslog_pri { } if "_grokparsefailure" not in [tags] { mutate { rename => ["cisco_message", "message"] remove_field => ["timestamp"] } } grok { match => [ "message", "%{CISCOFW106001}", "message", "%{CISCOFW106006_106007_106010}", "message", "%{CISCOFW106014}", "message", "%{CISCOFW106015}", "message", "%{CISCOFW106021}", "message", "%{CISCOFW106023}", "message", "%{CISCOFW106100}", "message", "%{CISCOFW110002}", "message", "%{CISCOFW302010}", "message", "%{CISCOFW302013_302014_302015_302016}", "message", "%{CISCOFW302020_302021}", "message", "%{CISCOFW305011}", "message", "%{CISCOFW313001_313004_313008}", "message", "%{CISCOFW313005}", "message", "%{CISCOFW402117}", "message", "%{CISCOFW402119}", "message", "%{CISCOFW419001}", "message", "%{CISCOFW419002}", "message", "%{CISCOFW500004}", "message", "%{CISCOFW602303_602304}", "message", "%{CISCOFW710001_710002_710003_710005_710006}", "message", "%{CISCOFW713172}", "message", "%{CISCOFW733100}" ] } geoip { source => "src_ip" target => "geo_point" } } } } ``` And i have the following logmessages: > Jul 16 10:30:45 123.123.123.123 %ASA-4-434002: SFR requested to drop TCP packet from OUTSIDE-VRF180:123.123.123.123/80 to INSIDE-VRF4100:123.123.123.123/2651 According to my setup, the log message above should match the third regex, which is the following: `^%{CISCOTIMESTAMP:localtime}.%{IPORHOST:host}.%%{CISCOTAG:ciscotag}: SFR requested to %{WORD:action} %{WORD:protocol} packet from %{IPORHOST:src_interface}:%{IPORHOST:src_ip}/%{NUMBER:src_port}$` But when i view it in kibana, i can see that it gets tagged "\_grokparsefailure" and lacks any keyword after ciscotag, i.e. "action", "protocol" etc is missing while "ciscotag", "localtime" etc works fine. I have tried the grok expresseion in various online debuggers as well as the built-in debugger in kibana which shows that there are no errors and should work. Can anyone help identify where the problem lies? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 16, 2018, 10:24am UTC](https://discuss.elastic.co/t/grok-is-succesfull-in-various-debuggers-but-fails-in-practice-with-specific-keyword/140112/2 "2018-07-16T10:24:44Z")
The first part shoudl match. I would not expect ``` %{IPORHOST:src_interface}:%{IPORHOST:src_ip}/%{NUMBER:src_port}$ ``` (anchored to end of line) to match ``` OUTSIDE-VRF180:123.123.123.123/80 to INSIDE-VRF4100:123.123.123.123/2651 ``` ---
**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Post date:** [July 16, 2018, 10:38am UTC](https://discuss.elastic.co/t/grok-is-succesfull-in-various-debuggers-but-fails-in-practice-with-specific-keyword/140112/3 "2018-07-16T10:38:02Z")
Ah so sorry, i pasted the wrong grok expression for the log i submitted. That's fixed now. You are indeed correct in that it doesn't work. I think i've fixed it with the following regex: `%{CISCOTIMESTAMP:localtime}.%{IPORHOST:host} %%{CISCOTAG:ciscotag}: %{WORD} %{WORD} %{WORD} %{WORD:action} %{WORD:protocol} %{WORD} %{WORD} %{HOSTNAME:src_interface}:%{IP:src_ip}/%{NUMBER:src_port} %{WORD} %{HOSTNAME:dst_interface}:%{IP:dst_ip}/%{NUMBER:dst_port}` EDIT: Definetly not fixed, still has the same issues as before. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 13, 2018, 10:44am UTC](https://discuss.elastic.co/t/grok-is-succesfull-in-various-debuggers-but-fails-in-practice-with-specific-keyword/140112/4 "2018-08-13T10:44:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.