GROK Parsing Problem - IP within brackets AND parentheses

Elastic Stack Logstash
1

Hello. I am having some trouble parsing the following log:

<14>Jul 26 13:37:17 NL-Syn1-RI Connection: User [SYNNAS\WIN7$] from [192.168.10.111(192.168.10.111)] via [CIFS(SMB2)] accessed shared folder [sysvol].

This is what I have at the moment for my GROK pattern:

`<%{POSINT:syslog_pri}>(?<timestamp>(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) ?%{SYSLOGHOST:log_source} %{WORD:service}: User \[(?:%{WORD:user_domain}\\)\\?%{DATA:username}\] from \[%{IP:source_ip}|%({IP:source_ip})\] via \[%{DATA:protocol}\] accessed shared folder \[%{DATA:shared_folder}\].`

I am able to parse out everything up until "via [CIFS(SMB2)] accessed shared folder [sysvol]." The two fields "protocol" and "shared folder" display "null" on the GROK debugger. However, when splitting the log, beginning at "via", the two halves parse out perfectly fine with the current grok pattern. I tried many different ideas, but I haven't been able to find a solution.

2

Please indent the grok pattern by 4 spaces, so that we can see what you have escaped.

4

Not fixed yet.

5

Is it okay now?

6

Yes, that's better. This does not match "[192.168.10.111(192.168.10.111)]".

 \[%{IP:source_ip}|%({IP:source_ip})\]

Change that to

 \[%{IP:source_ip}\(%{IP:source_ip}\)\]

Note that it will create an array because the two fields have the same name.

7

That did the trick, thanks a ton Badger!

I have one other question, where would I place "%{GREEDYDATA:message}" if I want it to contain "User [SYNNAS\WIN7$] from [192.168.10.111(192.168.10.111)] via [CIFS(SMB2)] accessed shared folder [sysvol]."

8

You would replace everything after '%{WORD:service}: ' (that has a trailing space) with %{GREEDYDATA:message}. Then look at the output and realize you don't want to call it message :slight_smile:

9

Ahh I see lol thanks for your help!

I was going to start a new thread, but I might as well as here...

What have I done wrong here?

log:

NAS\Admin:\tShared folder [test] was deleted.

`%{WORD:user_domain}\\%{DATA:username}:\tShared folder \[%{DATA:folder_name}\] was %{WORD:action}.`
10

If the \t in the message is literally \t, then you need to have \\t in the grok pattern. If it is a tab then you need a tab in the grok pattern.

11

Yup I was missing an extra \

It's always something small that I miss lol thanks again!