# Grok pattern construction

**URL:** <https://discuss.elastic.co/t/grok-pattern-construction/305850>\
**Category:** Logstash\
**Created:** [May 28, 2022, 11:09am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850 "2022-05-28T11:09:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [May 28, 2022, 11:09am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/1 "2022-05-28T11:09:15Z")

</div>

Hi, i need help in constructing the grok pattern for the following logs.  
had asked the same question earlier here-

> [@Grok pattern construction](https://discuss.elastic.co/t/grok-pattern-construction/301610):
>
> Hi, I need help constructing the grok pattern for the following log messages Fri Mar 18 17:43:27 2022 : Info: Debugger not attached Fri Mar 18 17:43:27 2022 : Info: Loaded virtual server inner-tunnel Fri Mar 18 17:43:27 2022 : Info: Loaded virtual server \<default\> TIMESTAMP\_ISO8601 does not seem to match the format. new to elk, help would be appreciated Thank you!

this pattern %{HTTPDERROR\_DATE:date}\s:\s%{LOGLEVEL:log}:%{GREEDYDATA:message} works for the following log messages -

```auto
Wed Jan 12 07:10:57 2022 : Info: Signalled to terminate
Wed Jan 12 07:10:57 2022 : Info: Exiting normally
Wed Jan 12 07:13:52 2022 : Info: Debugger not attached

```

but i also have log entries such as-

```auto
Wed Jan 12 19:56:01 2022 : Auth: (12) Login OK: [AIR_CANADA_ADG-WAP-BL_1@/<via Auth-Type = Accept>] (from client 127.0.0.1 port 1 cli F0-D5-BF-8D-2B-38 via TLS tunnel)
Wed Jan 12 19:56:01 2022 : Auth: (12) Login OK: [AIR_CANADA_ADG-WAP-BL_1@/<via Auth-Type = eap>] (from client 127.0.0.1 port 1 cli F0-D5-BF-8D-2B-38)

```

need help constructing the pattern for these entries as Auth is not recognized as a LOG LEVEL

Thanks in advance

---

<div class="post-metadata">

**Author:** ![sudhagar\_ramesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhagar_ramesh/32/105673_2.png) [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)\
**Post date:** [May 29, 2022, 5:42am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/2 "2022-05-29T05:42:53Z")

</div>

Hello @anushka1203

Hope this below GROK pattern will help you. Attaching screenshot for your reference

```auto
%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} : %{WORD:loglevel}: %{GREEDYDATA:message}

```

 ![grok_1](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5a5079cb6c26e1bcc6d217eba2669d6613c71e0.jpeg)

 ![grok_2.jpeg](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4b8c6bb06549e1ed863115f5eee2c495d0a878b5.png)

Keep Posted !!! Thanks 🙂 !!!

---

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [May 29, 2022, 10:57am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/3 "2022-05-29T10:57:39Z")

</div>

thank you so much this works. but may i know how I can retrieve further fields when the loglevel is Auth?

```auto
Wed Jan 12 19:56:01 2022 : Auth: (12) Login OK: [AIR_CANADA_ADG-WAP-BL_1@/<via Auth-Type = eap>] (from client 127.0.0.1 port 1 cli F0-D5-BF-8D-2B-38)

```

as in if i need the number 12 extracted in a field called number and OK as a value in a field called login status

---

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [May 29, 2022, 5:50pm UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/5 "2022-05-29T17:50:23Z")

</div>

unable to see the reply?

---

<div class="post-metadata">

**Author:** ![sudhagar\_ramesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhagar_ramesh/32/105673_2.png) [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)\
**Post date:** [May 30, 2022, 4:31am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/6 "2022-05-30T04:31:39Z")

</div>

Hello @anushka1203

if you further would like to extract field , as per this below mentioned grok pattern "loglevel" is **Auth** then you have to use **field reference**. for more information check the if condition in the below page. this below pattern would not be a match for **info**.

> **[Accessing event data and fields in the configuration | Logstash Reference...](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)**

For Further field extraction as you requested

```auto
%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} : %{WORD:loglevel}: \(%{NUMBER:number}\)\s* %{DATA:login_status} %{DATA:value}: %{GREEDYDATA:message}

```

Keep Posted!!! Thanks !!! 🙂

---

<div class="post-metadata">

**Author:** ![sudhagar\_ramesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhagar_ramesh/32/105673_2.png) [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)\
**Post date:** [June 3, 2022, 4:04am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/7 "2022-06-03T04:04:23Z")

</div>

Hello @anushka1203

```auto
if [loglevel] == "Auth" {
grok {
match => 
{ 
"message" => "%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} : %{WORD:loglevel}: \(%{NUMBER:number}\)\s* %{DATA:login_status} %{DATA:value}: %{GREEDYDATA:message}" 
}

```

Hope this helps !!! Keep Posted !!! Thanks 🙂

}

---

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [June 3, 2022, 9:09am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/8 "2022-06-03T09:09:02Z")

</div>

Hi @sudhagar_ramesh  
Sorry for the late reply, this works. Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2022, 9:09am UTC](https://discuss.elastic.co/t/grok-pattern-construction/305850/9 "2022-07-01T09:09:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.