# GROK pattern help for Audit Log

**URL:** https://discuss.elastic.co/t/grok-pattern-help-for-audit-log/343761
**Category:** Logstash
**Created:** [September 25, 2023, 12:59pm UTC](https://discuss.elastic.co/t/grok-pattern-help-for-audit-log/343761 "2023-09-25T12:59:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ataylor](https://avatars.discourse-cdn.com/v4/letter/a/e495f1/32.png) [@ataylor](https://discuss.elastic.co/u/ataylor)
#### Post date: [September 25, 2023, 12:59pm UTC](https://discuss.elastic.co/t/grok-pattern-help-for-audit-log/343761/1 "2023-09-25T12:59:34Z")

</div>

I am struggling to find an appropriate GROK pattern to appropriately dissect my log that is being generated by the xpack Audit.

My Logs currently look like

`{"type":"audit", "timestamp":"2023-09-07T14:34:58,359+0100", "node.id":"MFOk8jclQlW3-fVz7xHghQ", "event.type":"transport", "event.action":"access_granted", "authentication.type":"REALM", "user.name":"kibana_system", "user.realm":"reserved", "user.roles":["kibana_system"], "origin.type":"transport", "origin.address":"xx.xx.xx.xxx:xxxxx", "request.id":"5f7V2f5HQWeMIdi3B1qcZQ", "action":"cluster:monitor/nodes/info[n]", "request.name":"NodeInfoRequest"}`

I am quite surprised that there doesn't appear to be a pre-written filter for this, given that it is the log generated by elastic.

Can anyone provide any advice

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 25, 2023, 1:41pm UTC](https://discuss.elastic.co/t/grok-pattern-help-for-audit-log/343761/2 "2023-09-25T13:41:19Z")

</div>

Hello,

> [@ataylor](#):
>
> I am struggling to find an appropriate GROK pattern to appropriately dissect my log that is being generated by the xpack Audit.

This log is a json document, you should use the json filter, not grok.

> [@ataylor](#):
>
> I am quite surprised that there doesn't appear to be a pre-written filter for this, given that it is the log generated by elastic.

There is, but you need to use filebeat or elastic agent, check this [blog post](https://www.elastic.co/blog/indexing-elasticsearch-audit-logs-with-filebeat).

If you still want to use Logstash you will probably need an ingests pipeline on Elasticsearch side to use the `dot_expander` processor.

---

<div class="post-metadata">

### Author: ![ataylor](https://avatars.discourse-cdn.com/v4/letter/a/e495f1/32.png) [@ataylor](https://discuss.elastic.co/u/ataylor)
#### Post date: [September 25, 2023, 2:48pm UTC](https://discuss.elastic.co/t/grok-pattern-help-for-audit-log/343761/3 "2023-09-25T14:48:14Z")

</div>

Thanks for the reply!

I will look into it 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2023, 2:48pm UTC](https://discuss.elastic.co/t/grok-pattern-help-for-audit-log/343761/4 "2023-10-23T14:48:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.