# Grok sssd messages, like "\[sssd\[krb5\_child\[7502\]\]\]"

**URL:** <https://discuss.elastic.co/t/grok-sssd-messages-like-sssd-krb5-child-7502/213751>\
**Category:** Logstash\
**Created:** [January 3, 2020, 10:11pm UTC](https://discuss.elastic.co/t/grok-sssd-messages-like-sssd-krb5-child-7502/213751 "2020-01-03T22:11:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Willl](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@Willl](https://discuss.elastic.co/u/Willl)\
**Post date:** [January 3, 2020, 10:11pm UTC](https://discuss.elastic.co/t/grok-sssd-messages-like-sssd-krb5-child-7502/213751/1 "2020-01-03T22:11:58Z")

</div>

I'm testing a Grok pattern for sssd messages like this one:

> 2020-01-03T16:28:24.968540-05:00 ny2dev10 [sssd[krb5\_child[7312]]]: Preauthentication failed

I ran Grok Debugger with the following pattern and it looks fine. (yes, I try to ignore "krb5\_child").

> %{TIMESTAMP\_ISO8601:timestamp} %{SYSLOGHOST:hostname} [%{WORD:[process][name]}[%{WORD}[%{NUMBER:[process][pid]}]]]: %{GREEDYDATA:message}

> {  
> "hostname": "dev10",  
> "[process][pid]": "7312",  
> "message": "Preauthentication failed",  
> "[process][name]": "sssd",  
> "timestamp": "2020-01-03T16:28:24.968540-05:00"  
> }

However, when I run it with Ruby debug, I got something like this:

> {  
> "hostname" =\> "dev10",  
> "message" =\> "Preauthentication failed",  
> "timestamp" =\> "2020-01-03T17:05:22.670995-05:00",  
> "process" =\> {  
> "name" =\> "[sssd[krb5\_child[7502]]]"  
> },  
> "fileset" =\> {  
> "name" =\> "syslog"  
> },

I'm moving forward with my tests with ELK, but I think I still need to read up more about grok and logstash. May be WORD is not what I think it is?

Thanks  
W

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2020, 10:12pm UTC](https://discuss.elastic.co/t/grok-sssd-messages-like-sssd-krb5-child-7502/213751/2 "2020-01-31T22:12:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.