# Grok pattern for suricata/barnyard alert in COMPLETE mode

**URL:** <https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009>\
**Category:** Logstash\
**Created:** [October 6, 2022, 8:05pm UTC](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009 "2022-10-06T20:05:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mvrk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvrk/32/111767_2.png) [@mvrk](https://discuss.elastic.co/u/mvrk)\
**Post date:** [October 6, 2022, 8:05pm UTC](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009/1 "2022-10-06T20:05:26Z")

</div>

Hi,

I have my suricata in pfsense sending the alerts using barnyard in COMPLETE mode to my greylog server.

Example message:

| [SNORTIDS[ALERT]: [pfsense.local] ] || 2022-10-06 19:13:55.186+001 2 [1:2403344:77870] ET CINS Active Threat Intelligence Poor Reputation IP group 45 || misc-attack || 6 45.95.147.51 192.168.54.100 || 59856 443 ||  
|

I tried with this expression:

\| \[%{DATA:ids}[%{DATA:UNWANTED}\]: \[%{HOSTNAME:ids\_host}\] \] \|| %{DATE:date} %{TIME:time}.%{NUMBER:UNWANTED}+%{NUMBER:UNWANTED} %{NUMBER:priority} \[%{NUMBER:UNWANTED}:%{NUMBER:UNWANTED}:%{NUMBER:UNWANTED}\] %{DATA:description} \|| %{DATA:classification} \|| %{NUMBER:protocol} %{IP:src\_ip} %{IP:dst\_ip} \|| %{NUMBER:src\_port} %{NUMBER:dst\_port} \||  
\|

But i only get this as result:

ids  
SNORTIDS  
ids\_host  
pfsense.local

Those double pipes seem to be the problem, as anyone has any idea how to work those double pipes (||)?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 6, 2022, 8:35pm UTC](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009/2 "2022-10-06T20:35:47Z")

</div>

Double pipes are backslashpipebackslashpipe.  
This is working in debugger:

```auto
\|%{SPACE}\[%{DATA:ids}\[%{DATA:type}\]:%{SPACE}\[%{HOSTNAME:ids_host}\]%{SPACE}\]%{SPACE}\|\|%{SPACE}%{TIMESTAMP_ISO8601:date}%{SPACE}%{NUMBER:priority}%{SPACE}\[%{NUMBER}:%{NUMBER}:%{NUMBER}\]%{SPACE}%{DATA:description}%{SPACE}\|\|%{SPACE}%{DATA:classification} \|\|%{SPACE}%{NUMBER:protocol}%{SPACE}%{IP:src_ip}%{SPACE}%{IP:dst_ip}%{SPACE}\|\|%{SPACE}%{NUMBER:src_port}%{SPACE}%{NUMBER:dst_port}%{SPACE}\||
\|

```

---

<div class="post-metadata">

**Author:** ![mvrk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvrk/32/111767_2.png) [@mvrk](https://discuss.elastic.co/u/mvrk)\
**Post date:** [October 6, 2022, 9:12pm UTC](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009/3 "2022-10-06T21:12:37Z")

</div>

> [@Rios](#):
>
> ```auto
> \|%{SPACE}\[%{DATA:ids}\[%{DATA:type}\]:%{SPACE}\[%{HOSTNAME:ids_host}\]%{SPACE}\]%{SPACE}\|\|%{SPACE}%{TIMESTAMP_ISO8601:date}%{SPACE}%{NUMBER:priority}%{SPACE}\[%{NUMBER}:%{NUMBER}:%{NUMBER}\]%{SPACE}%{DATA:description}%{SPACE}\|\|%{SPACE}%{DATA:classification} \|\|%{SPACE}%{NUMBER:protocol}%{SPACE}%{IP:src_ip}%{SPACE}%{IP:dst_ip}%{SPACE}\|\|%{SPACE}%{NUMBER:src_port}%{SPACE}%{NUMBER:dst_port}%{SPACE}\||
> \|
> 
> ```

Thank you, works perfectly

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2022, 9:12pm UTC](https://discuss.elastic.co/t/grok-pattern-for-suricata-barnyard-alert-in-complete-mode/316009/4 "2022-11-03T21:12:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.