# GROK Parsing Problem - IP within brackets AND parentheses **URL:** \ **Category:** Logstash\ **Created:** [July 26, 2018, 8:04pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845 "2018-07-26T20:04:43Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![NeQter](https://avatars.discourse-cdn.com/v4/letter/n/7ea924/32.png) [@NeQter](https://discuss.elastic.co/u/NeQter)\ **Post date:** [July 26, 2018, 8:04pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/1 "2018-07-26T20:04:44Z")
Hello. I am having some trouble parsing the following log: \<14\>Jul 26 13:37:17 NL-Syn1-RI Connection: User [SYNNAS\WIN7$] from [192.168.10.111(192.168.10.111)] via [CIFS(SMB2)] accessed shared folder [sysvol]. This is what I have at the moment for my GROK pattern: ``` `<%{POSINT:syslog_pri}>(?(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) ?%{SYSLOGHOST:log_source} %{WORD:service}: User \[(?:%{WORD:user_domain}\\)\\?%{DATA:username}\] from \[%{IP:source_ip}|%({IP:source_ip})\] via \[%{DATA:protocol}\] accessed shared folder \[%{DATA:shared_folder}\].` ``` I am able to parse out everything up until "via [CIFS(SMB2)] accessed shared folder [sysvol]." The two fields "protocol" and "shared folder" display "null" on the GROK debugger. However, when splitting the log, beginning at "via", the two halves parse out perfectly fine with the current grok pattern. I tried many different ideas, but I haven't been able to find a solution. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 26, 2018, 9:12pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/2 "2018-07-26T21:12:37Z")
Please indent the grok pattern by 4 spaces, so that we can see what you have escaped. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 26, 2018, 9:47pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/4 "2018-07-26T21:47:12Z")
Not fixed yet. ---
**Author:** ![NeQter](https://avatars.discourse-cdn.com/v4/letter/n/7ea924/32.png) [@NeQter](https://discuss.elastic.co/u/NeQter)\ **Post date:** [July 26, 2018, 9:57pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/5 "2018-07-26T21:57:48Z")
Is it okay now? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 26, 2018, 10:19pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/6 "2018-07-26T22:19:25Z")
Yes, that's better. This does not match "[192.168.10.111(192.168.10.111)]". ``` \[%{IP:source_ip}|%({IP:source_ip})\] ``` Change that to ``` \[%{IP:source_ip}\(%{IP:source_ip}\)\] ``` Note that it will create an array because the two fields have the same name. ---
**Author:** ![NeQter](https://avatars.discourse-cdn.com/v4/letter/n/7ea924/32.png) [@NeQter](https://discuss.elastic.co/u/NeQter)\ **Post date:** [July 26, 2018, 10:38pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/7 "2018-07-26T22:38:21Z")
That did the trick, thanks a ton Badger! I have one other question, where would I place "%{GREEDYDATA:message}" if I want it to contain "User [SYNNAS\WIN7$] from [192.168.10.111(192.168.10.111)] via [CIFS(SMB2)] accessed shared folder [sysvol]." ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 27, 2018, 1:10am UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/8 "2018-07-27T01:10:00Z")
You would replace everything after '%{WORD:service}: ' (that has a trailing space) with %{GREEDYDATA:message}. Then look at the output and realize you don't want to call it message 🙂 ---
**Author:** ![NeQter](https://avatars.discourse-cdn.com/v4/letter/n/7ea924/32.png) [@NeQter](https://discuss.elastic.co/u/NeQter)\ **Post date:** [July 27, 2018, 1:47am UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/9 "2018-07-27T01:47:13Z")
Ahh I see lol thanks for your help! I was going to start a new thread, but I might as well as here... What have I done wrong here? log: NAS\Admin:\tShared folder [test] was deleted. ``` `%{WORD:user_domain}\\%{DATA:username}:\tShared folder \[%{DATA:folder_name}\] was %{WORD:action}.` ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 27, 2018, 12:07pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/10 "2018-07-27T12:07:48Z")
If the \t in the message is literally \t, then you need to have \\t in the grok pattern. If it is a tab then you need a tab in the grok pattern. ---
**Author:** ![NeQter](https://avatars.discourse-cdn.com/v4/letter/n/7ea924/32.png) [@NeQter](https://discuss.elastic.co/u/NeQter)\ **Post date:** [July 27, 2018, 1:12pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/11 "2018-07-27T13:12:14Z")
Yup I was missing an extra \ It's always something small that I miss lol thanks again! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 24, 2018, 1:12pm UTC](https://discuss.elastic.co/t/grok-parsing-problem-ip-within-brackets-and-parentheses/141845/12 "2018-08-24T13:12:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.