# Grok Pattern for barnyard2 syslog

**URL:** <https://discuss.elastic.co/t/grok-pattern-for-barnyard2-syslog/80136>\
**Category:** Logstash\
**Created:** [March 27, 2017, 1:05pm UTC](https://discuss.elastic.co/t/grok-pattern-for-barnyard2-syslog/80136 "2017-03-27T13:05:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shookshank](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@shookshank](https://discuss.elastic.co/u/shookshank)\
**Post date:** [March 27, 2017, 1:05pm UTC](https://discuss.elastic.co/t/grok-pattern-for-barnyard2-syslog/80136/1 "2017-03-27T13:05:04Z")

</div>

i have the following syslog alerts.

Oct 1 11:59:51 sensor | [SNORTIDS[ALERT]: [sensor-eth1] ] || 2014-10-01 11:59:54.967+-04 1 [1:1000022:1] LOCAL-RULE  
Possible login.aspx Brute Force Account Access || web-application-attack || 6 x.x.x.x y.y.y.y || 20175 80 || #012 |

I've attempted writing grok patterns for it but im completely new to them and require someone with better knowledge than me to split them into fields.

Any help would be appreciated.

Thank you

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 28, 2017, 6:04am UTC](https://discuss.elastic.co/t/grok-pattern-for-barnyard2-syslog/80136/2 "2017-03-28T06:04:07Z")

</div>

Have you tried using the grok constructor web site?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2017, 6:04am UTC](https://discuss.elastic.co/t/grok-pattern-for-barnyard2-syslog/80136/3 "2017-04-25T06:04:08Z")

</div>

Closed on April 25, 2017, 6:04am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.