Grok pattern construction

Elastic Stack Logstash
1

Hi, i need help in constructing the grok pattern for the following logs.
had asked the same question earlier here-

this pattern %{HTTPDERROR_DATE:date}\s:\s%{LOGLEVEL:log}:%{GREEDYDATA:message} works for the following log messages -

Wed Jan 12 07:10:57 2022 : Info: Signalled to terminate
Wed Jan 12 07:10:57 2022 : Info: Exiting normally
Wed Jan 12 07:13:52 2022 : Info: Debugger not attached

but i also have log entries such as-

Wed Jan 12 19:56:01 2022 : Auth: (12)   Login OK: [AIR_CANADA_ADG-WAP-BL_1@/<via Auth-Type = Accept>] (from client 127.0.0.1 port 1 cli F0-D5-BF-8D-2B-38 via TLS tunnel)
Wed Jan 12 19:56:01 2022 : Auth: (12) Login OK: [AIR_CANADA_ADG-WAP-BL_1@/<via Auth-Type = eap>] (from client 127.0.0.1 port 1 cli F0-D5-BF-8D-2B-38)

need help constructing the pattern for these entries as Auth is not recognized as a LOG LEVEL

Thanks in advance

2

Hello @anushka1203

Hope this below GROK pattern will help you. Attaching screenshot for your reference

%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} : %{WORD:loglevel}: %{GREEDYDATA:message}

grok_1
grok_1792×1205 55.2 KB

grok_2.jpeg
grok_2.jpeg778×1229 18.9 KB

Keep Posted !!! Thanks :slight_smile: !!!

3

thank you so much this works. but may i know how I can retrieve further fields when the loglevel is Auth?

Wed Jan 12 19:56:01 2022 : Auth: (12) Login OK: [AIR_CANADA_ADG-WAP-BL_1@/<via Auth-Type = eap>] (from client 127.0.0.1 port 1 cli F0-D5-BF-8D-2B-38)

as in if i need the number 12 extracted in a field called number and OK as a value in a field called login status

5

unable to see the reply?

6

Hello @anushka1203

if you further would like to extract field , as per this below mentioned grok pattern "loglevel" is Auth then you have to use field reference . for more information check the if condition in the below page. this below pattern would not be a match for info .

For Further field extraction as you requested

%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} : %{WORD:loglevel}: \(%{NUMBER:number}\)\s* %{DATA:login_status} %{DATA:value}: %{GREEDYDATA:message}

Keep Posted!!! Thanks !!! :slight_smile:

7

Hello @anushka1203

if [loglevel] == "Auth" {
grok {
match => 
{ 
"message" => "%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} : %{WORD:loglevel}: \(%{NUMBER:number}\)\s* %{DATA:login_status} %{DATA:value}: %{GREEDYDATA:message}" 
}

Hope this helps !!! Keep Posted !!! Thanks :slight_smile:

}

8

Hi @sudhagar_ramesh
Sorry for the late reply, this works. Thank you so much!

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.