# Grok pattern matching

**URL:** <https://discuss.elastic.co/t/grok-pattern-matching/217078>\
**Category:** Logstash\
**Created:** [January 29, 2020, 9:34pm UTC](https://discuss.elastic.co/t/grok-pattern-matching/217078 "2020-01-29T21:34:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![littlejob1](https://avatars.discourse-cdn.com/v4/letter/l/48db29/32.png) [@littlejob1](https://discuss.elastic.co/u/littlejob1)\
**Post date:** [January 29, 2020, 9:34pm UTC](https://discuss.elastic.co/t/grok-pattern-matching/217078/1 "2020-01-29T21:34:25Z")

</div>

Trying to figure out the most effective way to parse the following message being received via a syslog input.

\<134\>1 2020-01-29T21:18:07Z 10.10.10.10 PulseSecure: - - - 2020-01-29 21:18:07 - ssl - [4.4.4.4] domain\user(Com1-Reliable)[Com1-Reliable-Grp-TST] - Closed connection to TUN-VPN port 443 after 134 seconds, with 840437 bytes read (in 1 chunks) and 682532 bytes written (in 0 chunks)

\<134\>1 2020-01-29T21:26:10Z 10.10.10.10 PulseSecure: - - - 2020-01-29 21:26:10 - ibos1 - [4.4.4.4] user1(Com1-Reliable)[Com1-Reliable-Grp-TST] - Login succeeded for user1/Com1-Reliable (session:00000000) from 5.5.5.5 with Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0; Zoom 3.6.0).

Have attempted to leverage several pattern matches and building grok pattern sites to no real prevail. . any incite would be appreciated..

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [January 30, 2020, 12:49am UTC](https://discuss.elastic.co/t/grok-pattern-matching/217078/2 "2020-01-30T00:49:29Z")

</div>

Look toward the bottom of this [file on git](https://github.com/NETWAYS/graylog-pulsesecure-cp/blob/master/content_pack.json)

---

<div class="post-metadata">

**Author:** ![littlejob1](https://avatars.discourse-cdn.com/v4/letter/l/48db29/32.png) [@littlejob1](https://discuss.elastic.co/u/littlejob1)\
**Post date:** [January 30, 2020, 2:33pm UTC](https://discuss.elastic.co/t/grok-pattern-matching/217078/3 "2020-01-30T14:33:09Z")

</div>

im getting closer, trying to take the syslog message one field at a time.. stuck after the second date stamp..

log:  
\<134\>1 2020-01-29T21:26:10Z 10.10.10.10 PulseSecure: - - - 2020-01-29 21:26:10 - ibos1 - [4.4.4.4] user1(Com1-Reliable)[Com1-Reliable-Grp-TST] - Login succeeded for user1/Com1-Reliable (session:00000000) from 5.5.5.5 with Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0; Zoom 3.6.0).

pattern:  
%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}%{PROG:pulse\_appliance}%{SPACE}%{PROG:software}:%{SPACE}%{PROG:dash}%{SPACE}%{PROG:dash}%{SPACE}%{PROG:dash}%{SPACE}%{TIMESTAMP\_ISO8601:timestamp2}%{SPACE}%{PROG:dash}

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [January 30, 2020, 4:21pm UTC](https://discuss.elastic.co/t/grok-pattern-matching/217078/4 "2020-01-30T16:21:15Z")

</div>

This gets a little further, but I'm just guessing at the message layout.

```
%{TIMESTAMP_ISO8601:timestamp} %{PROG:pulse_appliance} %{PROG:software}: - - - %{TIMESTAMP_ISO8601:timestamp2} - %{WORD:w1} - \[%{NOTSPACE:ip}\] %{GREEDYDATA:user}\[%{GREEDYDATA:group}\] - %{GREEDYDATA:logmsg}

```

simulate results:

```
{
  "software": "PulseSecure",
  "logmsg": "Login succeeded for user1/Com1-Reliable (session:00000000) from 5.5.5.5 with Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0; Zoom 3.6.0).",
  "timestamp2": "2020-01-29 21:26:10",
  "ip": "4.4.4.4",
  "pulse_appliance": "10.10.10.10",
  "w1": "ibos1",
  "user": "user1(Com1-Reliable)",
  "timestamp": "2020-01-29T21:26:10Z",
  "group": "Com1-Reliable-Grp-TST"
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2020, 4:21pm UTC](https://discuss.elastic.co/t/grok-pattern-matching/217078/5 "2020-02-27T16:21:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.