# Grok parsing log failed!

**URL:** <https://discuss.elastic.co/t/grok-parsing-log-failed/28179>\
**Category:** Logstash\
**Created:** [August 27, 2015, 12:52pm UTC](https://discuss.elastic.co/t/grok-parsing-log-failed/28179 "2015-08-27T12:52:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mega\_robo](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@mega\_robo](https://discuss.elastic.co/u/mega_robo)\
**Post date:** [August 27, 2015, 12:52pm UTC](https://discuss.elastic.co/t/grok-parsing-log-failed/28179/1 "2015-08-27T12:52:17Z")

</div>

hi everyone :)))  
i have pfsense 2.2 that send logs to ELK and its work correctly but logstash not pars log and i see just raw data of logs in kibana that can not useful for my dashboard  
i see log in kibana like that :

 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3ecd8585e1cee9439394401d7cf91eaf9eba6e12.jpg)

this is my config files :

```
input {
    tcp {
        type => syslog
        port => 5010
    }
    udp {
        type => syslog
        port => 5010
    }
}
filter {  
  if "PFSense" in [tags] {
   grok {
      add_tag => ["firewall"]
      match => ["message", "<(?<evtid>.*)>(?<datetime>(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?<prog>.*?): (?<msg>.*)" ]
    }
    mutate {
      gsub => ["datetime"," "," "]
    }
    date {
      match => ["datetime", "MMM dd HH:mm:ss"]
    }
    mutate {
      replace => ["message", "%{msg}"]
    }
    mutate {
      remove_field => ["msg", "datetime"]
    }
   }
  if [prog] =~ /^filterlog$/ {  
    mutate {
      remove_field => ["msg", "datetime"]      
    }
    grok {
      patterns_dir => "/etc/logstash/patterns/"
      match => ["message", "%{LOG_DATA}%{IP_SPECIFIC_DATA}%{IP_DATA}%{PROTOCOL_DATA}"]
    }
    mutate {
      lowercase => ['proto']
    }
    geoip {
      add_tag => ["GeoIP"]
      source => "src_ip"
    }
  }
}
output {
 
  elasticsearch { host => localhost }
  stdout { codec => rubydebug }
}

  
LOG_DATA (%{INT:rule}),(%{INT:sub_rule}),,(%{INT:tracker}),(%{WORD:iface}),(%{WORD:reason}),(%{WORD:action}),(%{WORD:direction}),(%{INT:ip_ver}),

IP_SPECIFIC_DATA (%{IPv4_SPECIFIC_DATA}|%{IPv6_SPECIFIC_DATA})

IPv4_SPECIFIC_DATA (%{BASE16NUM:tos}),,(%{INT:ttl}),(%{INT:id}),(%{INT:offset}),(%{WORD:flags}),(%{INT:proto_id}),(%{WORD:proto}),

IPv6_SPECIFIC_DATA (%{BASE16NUM:class}),(%{DATA:flow_label}),(%{INT:hop_limit}),(%{WORD:proto}),(%{INT:proto_id}),

IP_DATA (%{INT:length}),(%{IP:src_ip}),(%{IP:dest_ip}),

PROTOCOL_DATA (%{TCP_DATA}|%{UDP_DATA}|%{ICMP_DATA})

TCP_DATA (%{INT:src_port}),(%{INT:dest_port}),(%{INT:data_length}),(%{WORD:tcp_flags}),(%{INT:sequence_number}),(%{INT:ack_number}),(%{INT:tcp_window}),(%{DATA:urg_data}),(%{DATA:tcp_options})

UDP_DATA (%{INT:src_port}),(%{INT:dest_port}),(%{INT:data_length})

ICMP_DATA (%{ICMP_TYPE}%{ICMP_RESPONSE})

ICMP_TYPE (?<icmp_type>(request|reply|unreachproto|unreachport|unreach|timeexceed|paramprob|redirect|maskreply|needfrag|tstamp|tstampreply)),

ICMP_RESPONSE (%{ICMP_ECHO_REQ_REPLY}|%{ICMP_UNREACHPORT}| %{ICMP_UNREACHPROTO}|%{ICMP_UNREACHABLE}|%{ICMP_NEED_FLAG}|%{ICMP_TSTAMP}|%{ICMP_TSTAMP_REPLY})

ICMP_ECHO_REQ_REPLY (%{INT:icmp_echo_id}),(%{INT:icmp_echo_sequence})

ICMP_UNREACHPORT (%{IP:icmp_unreachport_dest_ip}),(%{WORD:icmp_unreachport_protocol}),(%{INT:icmp_unreachport_port})

ICMP_UNREACHPROTO (%{IP:icmp_unreach_dest_ip}),(%{WORD:icmp_unreachproto_protocol})

ICMP_UNREACHABLE (%{GREEDYDATA:icmp_unreachable})

ICMP_NEED_FLAG (%{IP:icmp_need_flag_ip}),(%{INT:icmp_need_flag_mtu})

ICMP_TSTAMP (%{INT:icmp_tstamp_id}),(%{INT:icmp_tstamp_sequence})

ICMP_TSTAMP_REPLY (%{INT:icmp_tstamp_reply_id}),(%{INT:icmp_tstamp_reply_sequence}),(%{INT:icmp_tstamp_reply_otime}),(%{INT:icmp_tstamp_reply_rtime}),(%{INT:icmp_tstamp_reply_ttime})

```

any help to solve this problem

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/grok-parsing-log-failed/28179/2 "2017-07-06T05:30:45Z")

</div>