# Help grok filter , unstructured data **URL:** \ **Category:** Logstash\ **Created:** [July 19, 2017, 5:11pm UTC](https://discuss.elastic.co/t/help-grok-filter-unstructured-data/93816 "2017-07-19T17:11:10Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![ramzi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramzi/32/133117_2.png) [@ramzi](https://discuss.elastic.co/u/ramzi)\ **Post date:** [July 19, 2017, 5:11pm UTC](https://discuss.elastic.co/t/help-grok-filter-unstructured-data/93816/1 "2017-07-19T17:11:11Z")
Hello guys , i'm a beginner in this ELK, i'm facing a little problem and i would really appreciate some help from you ,so i have a WAF log file with some non structured content and i want to parse it and extract few informations and not all, and make it structred (the extracted data) and send it Elasticsearch, I heard about a function called GROK which can filter non structured data but i didn't know how to use it and make it work , i really wish if someone could give me a hand concerning this function. i have an example log file and demonstrat what i want this is my log file : ![](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a68eff8a1c412fc70c6be2253817816e82de8e1f.png) and the underlined is what i want to exract and send to elasticsearch. thakns guys. log file : --514cec3a-A-- [19/Jul/2017:17:37:26 +0100] WW@Kxn8AAQEAAGwE4wgAAAAA 127.0.0.1 55420 127.0.0.1 80 --514cec3a-B-- GET /a/a2/passage.php?login=admin%27+or+%271%27%3D%271%27%23&password=xzszx HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:54.0) Gecko/20100101 Firefox/54.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,_/_;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: [http://127.0.0.1/a/a2/](http://127.0.0.1/a/a2/) Connection: keep-alive Upgrade-Insecure-Requests: 1 --514cec3a-E-- 403 Forbidden # Forbidden You don't have permission to access /a/a2/passage.php * * * Apache/2.4.7 (Ubuntu) Server at 127.0.0.1 Port 80 --514cec3a-H-- Message: Access denied with code 403 (phase 2). Pattern match "(?i:([\s'"`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\\(\\)]*?)\\b([\\d\\w]++)([\\s'\"`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\(\)]_?)(?:(?:=|\<=\>|r?like|sounds\s+like|regexp)([\s'"`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\(\)]_?)\2\b|(?:!=|\<=|\>=|\<\>|\<|\>|\^|is\s+not ..." at ARGS:login. [file "/usr/share/modsecurity-crs/activated\_rules/modsecurity\_crs\_41\_sql\_injection\_attacks.conf"] [line "77"] [id "950901"] [rev "2"] [msg "SQL Injection Attack: SQL Tautology Detected."] [data "Matched Data: '1'='1 found within ARGS:login: admin' or '1'='1'#"] [severity "CRITICAL"] [ver "OWASP\_CRS/2.2.8"] [maturity "9"] [accuracy "8"] [tag "OWASP\_CRS/WEB\_ATTACK/SQL\_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP\_TOP\_10/A1"] [tag "OWASP\_AppSensor/CIE1"] [tag "PCI/6.5.2"] Action: Intercepted (phase 2) Apache-Handler: application/x-httpd-php Stopwatch: 1500482246101314 649 (- - -) Stopwatch2: 1500482246101314 649; combined=224, p1=114, p2=100, p3=0, p4=0, p5=8, sr=12, sw=2, l=0, gc=0 Response-Body-Transformed: Dechunked Producer: ModSecurity for Apache/2.7.7 ([http://www.modsecurity.org/](http://www.modsecurity.org/)); OWASP\_CRS/2.2.8. Server: Apache/2.4.7 (Ubuntu) Engine-Mode: "ENABLED" --514cec3a-Z-- ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 16, 2017, 5:11pm UTC](https://discuss.elastic.co/t/help-grok-filter-unstructured-data/93816/2 "2017-08-16T17:11:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.