# Help with grok **URL:** \ **Category:** Logstash\ **Created:** [March 17, 2016, 8:42pm UTC](https://discuss.elastic.co/t/help-with-grok/44772 "2016-03-17T20:42:07Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Jorge](https://avatars.discourse-cdn.com/v4/letter/j/9fc29f/32.png) [@Jorge](https://discuss.elastic.co/u/Jorge)\ **Post date:** [March 17, 2016, 8:42pm UTC](https://discuss.elastic.co/t/help-with-grok/44772/1 "2016-03-17T20:42:07Z")
Hi all, I have the following log , as you can see , it consists of different lines and each of the lines may have different fields such system id : As you can see the titles of the fields carry ( : ) . The first line is the general heading . I need help to create the grok to parse this log. As you can see the second log , it is different from the first , but both come in the same file Sample: Security alarm (SECURITY) and security audit (SECURITY) on YBOR, system id: 18432 Auditable event: System UAF record modification Event time: 4-FEB-2016 14:21:31.39 PID: 204CD4E0 Process name: TCPIP$SS\_BG3428 Username: TCPIP$SSH Process owner: [TCPIP$AUX,TCPIP$SSH] Image name: $4$DKA0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$SSH\_SSHD2.EXE Object class name: FILE Object name: SYS$COMMON:[SYSEXE]SYSUAF.DAT;1 User record: PROD$GRAB Flags: New: (none) Original: (none) Login failures: New: 1 Original: 0 Posix UID: -2 Posix GID: -2 (%XFFFFFFFE) Security alarm (SECURITY) and security audit (SECURITY) on YBOR, system id: 18432 Auditable event: Network login failure Event time: 4-FEB-2016 14:21:31.42 PID: 204CD4E0 Process name: TCPIP$SS\_BG3428 Username: PROD$GRAB Remote nodename: SSH\_PASSWORD:TC0 Remote username: PROD$GRAB(LOCAL) Status: %LOGIN-F-NOTVALID, user authorization failure Thx Advance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/help-with-grok/44772/2 "2017-07-06T05:06:35Z")