# Grok parsing using custom pattern

**URL:** https://discuss.elastic.co/t/grok-parsing-using-custom-pattern/92309
**Category:** Logstash
**Created:** [July 7, 2017, 6:09pm UTC](https://discuss.elastic.co/t/grok-parsing-using-custom-pattern/92309 "2017-07-07T18:09:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)
#### Post date: [July 7, 2017, 6:09pm UTC](https://discuss.elastic.co/t/grok-parsing-using-custom-pattern/92309/1 "2017-07-07T18:09:11Z")

</div>

Hi  
I am trying to parse a log file using grok. Basically trying to write and test grok pattern in [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) The patterns for the two words log `"[**] [1:2123:5]"` that i came upon is `[**] \\[%{NUMBER\\:NUMBER\\:NUMBER:threat}\\]` using custom pattern. But the grok debugger produces only curly bracket. Any insight on the grok pattern that i am missing will be appreciated . Also how can i fetch the value of level from the following log line.

`[**] [1:2123:5] some text here [level: 4]`

Regards

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 11, 2017, 3:11pm UTC](https://discuss.elastic.co/t/grok-parsing-using-custom-pattern/92309/2 "2017-07-11T15:11:51Z")

</div>

```
\[\*\*\] \[%{NUMBER:a}:%{NUMBER:b}:%{NUMBER:c}\] %{GREEDYDATA:whatever} \[level: %{NUMBER:level}\]
```

---

<div class="post-metadata">

### Author: ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)
#### Post date: [July 12, 2017, 3:25pm UTC](https://discuss.elastic.co/t/grok-parsing-using-custom-pattern/92309/3 "2017-07-12T15:25:03Z")

</div>

> [@magnusbaeck](#):
>
> [level: %{NUMBER:level}]

Hi  
@magnusbaeck Thank you again. With your input, I have been able to parse the log using following pattern. I do understand now why a single space in pattern also matters.

The log line

* * *

`[**] [1:2123:5] INDICATOR-COMPROMISE Microsoft cmd.exe banner [**][Classification: Successful Administrator Privilege Gain] [Priority: 1] 01/13-21:51:52.996103 192.168.1.2:80 -> 192.168.1.3:1404 TCP TTL:64 TOS:0x0 ID:1997 IpLen:20 DgmLen:128 Seq: 0xBD0F2FED Ack: 0x23C533C0 Win: 0xFFFF TcpLen: 20 [Xref => http://cgi.nessus.org/plugins/dump.php3?id=11633]`

The pattern

* * *

`\[\*\*\] \[%{NUMBER:a}:%{NUMBER:b}:%{NUMBER:c}\] %{GREEDYDATA:whatever} \[\*\*\]\[Classification: %{GREEDYDATA:Classification}\] \[Priority: %{NUMBER:Priority}\] %{GREEDYDATA:date1}\-%{GREEDYDATA:time1} %{IP:sip}:%{NUMBER:sport} -> %{IP:dip}:%{NUMBER:dport} %{GREEDYDATA:protocol} TTL:%{NUMBER:TTL} TOS:%{GREEDYDATA:TOS} ID:%{NUMBER:ID} IpLen:%{NUMBER:IpLen} DgmLen:%{NUMBER:DgmLen} Seq: %{GREEDYDATA:seq} Ack: %{GREEDYDATA:ack} Win: %{GREEDYDATA:win} TcpLen: %{NUMBER:TcpLen} \[Xref => %{GREEDYDATA:url}\]`

 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c9f0a4dd3a6ecf2ffa34577ca43bb53cd805c06.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 9, 2017, 3:25pm UTC](https://discuss.elastic.co/t/grok-parsing-using-custom-pattern/92309/4 "2017-08-09T15:25:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.