Grok match

Elastic Stack Logstash
1

Hello!
I'm just starting to work with a stack of ELK. Config was created by another engineer. Explain how it works, please.

                    grok {
                            match => { "message" => "\A.*%{IP:hostIP}.*%{CISCOTIMESTAMP}.*?(?<APPNAME>%[A-Za-z_]+)-(?<SEVERITY_LEVEL>\d{1})-(?<MSGNAME>[A-Za-z_]+).*?(?<MSG>[^:]+$)" }
                    }
2

Logs file to analyze:

May 8 14:28:22 *Mar 1 00:00:02.923: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.109.4 started - CLI initiated
May 8 14:28:33 *Mar 1 00:00:03.235: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
May 8 14:28:33 *Mar 1 00:00:03.259: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up
May 8 14:28:33 *Mar 1 00:00:03.283: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to up
May 8 14:28:33 Mar 1 00:00:04.235: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
May 8 14:28:33 Mar 1 00:00:04.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
May 8 14:28:33 Mar 1 00:00:04.283: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0, changed state to up
May 8 14:28:34 Mar 1 00:00:09.239: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.109.4 started - reconnection
May 8 14:28:46 Mar 1 00:00:24.095: %DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0/1 assigned DHCP address 192.168.137.104, mask 255.255.255.0, hostname R1
May 8 14:28:46
May 8 14:56:04 May 8 21:56:03.760: %SYS-5-CONFIG_I: Configured from console by console

3

What the grok match does is provide a pattern to match the log, so it can extract various fields and build a message with those.