# \_grokparsefailure, \_geoip\_lookup\_failure sophos utm

**URL:** <https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167>\
**Category:** Logstash\
**Created:** [January 29, 2019, 12:46pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167 "2019-01-29T12:46:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![fooc](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@fooc](https://discuss.elastic.co/u/fooc)\
**Post date:** [January 29, 2019, 12:46pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167/1 "2019-01-29T12:46:12Z")

</div>

Hi,

I'm using the following conf file to process my syslog messages from a sophos utm:

input {  
tcp {

# type =\> "utm-syslog"

```
port => 5140

```

}  
}

filter {

# if [type] == "utm-syslog" {

grok {  
match =\> { "message" =\> "\<%{POSINT:syslog\_pri}\>%{DATA:syslog\_timestamp} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}[%{NUMBER:syslog\_pid}]: %{GREEDYDATA:syslog\_message}" }  
}  
date {  
match =\> ["syslog\_timestamp", "yyyy:MM:dd-HH:mm:ss"]  
}  
kv {  
source =\> "syslog\_message"  
}  
mutate {  
replace =\> ["type", "%{syslog\_program}"]  
remove\_field =\> ["syslog\_message", "syslog\_timestamp"]  
}

if [type] == "httpproxy" {  
grok { match =\> { "url" =\> "(?https?)://%{IPORHOST:url\_domain}/" } }

}  
geoip {  
source =\> "dstip"  
}  
geoip {  
source =\> "srcip"  
}

} # end of filter

output {

# if [type] == "utm-syslog" {

elasticsearch {  
hosts =\> ["10.255.254.27:9200"]  
index =\> "logstash-utm-%{+YYYY.MM.dd}"

}

# stdout { codec =\> rubydebug }

}

In normal firewall messages the geoip works well, but in messages from the waf (web application firewall) i get the grokparse failure messages:

 ![grok](https://us1.discourse-cdn.com/elastic/original/3X/0/5/055b48aad5dfb9fc993721f1945694711f16ced7.png)

In the message a srcip is present, i can't understand why I'm getting the errors.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 29, 2019, 1:34pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167/2 "2019-01-29T13:34:43Z")

</div>

You grok pattern expects syslog\_program to be followed by syslog\_pid in square brackets. Your message does not have that so it does not match.

Please do not post screenshots of text, just post the text.

---

<div class="post-metadata">

**Author:** ![fooc](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@fooc](https://discuss.elastic.co/u/fooc)\
**Post date:** [January 30, 2019, 3:23pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167/3 "2019-01-30T15:23:03Z")

</div>

> [@Badger](#):
>
> square brackets

Can I just remove the square brackets?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 30, 2019, 3:31pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167/4 "2019-01-30T15:31:24Z")

</div>

Removing the square brackets is an option, but I assume they were added to the pattern because you have some lines that contain them. In that case you can match against multiple patterns using

```
grok { match { "message" => ["firstPattern", "secondPattern"] } }

```

Where one pattern has the brackets and one does not.

BTW you should anchor your grok patterns whenever possible.

```
match => { "message" => "<%{POSINT:syslog_pri}>%{DATA:syslog_timestamp} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}[%{NUMBER:syslog_pid}]: %{GREEDYDATA:syslog_message}" }

```

is a lot slower than

```
match => { "message" => "^<%{POSINT:syslog_pri}>%{DATA:syslog_timestamp} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}[%{NUMBER:syslog_pid}]: %{GREEDYDATA:syslog_message}" }
```

---

<div class="post-metadata">

**Author:** ![fooc](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@fooc](https://discuss.elastic.co/u/fooc)\
**Post date:** [January 30, 2019, 3:36pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167/5 "2019-01-30T15:36:00Z")

</div>

Thanx for your quick reply, i copied the conf from internet and the basics were working for me, just not the waf messages.  
I have to learn how to write it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2019, 3:36pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-sophos-utm/166167/6 "2019-02-27T15:36:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.