# Help with my grok statement

**URL:** <https://discuss.elastic.co/t/help-with-my-grok-statement/155215>\
**Category:** Logstash\
**Created:** [November 2, 2018, 5:44pm UTC](https://discuss.elastic.co/t/help-with-my-grok-statement/155215 "2018-11-02T17:44:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frank\_Shearer](https://avatars.discourse-cdn.com/v4/letter/f/45deac/32.png) [@Frank\_Shearer](https://discuss.elastic.co/u/Frank_Shearer)\
**Post date:** [November 2, 2018, 5:44pm UTC](https://discuss.elastic.co/t/help-with-my-grok-statement/155215/1 "2018-11-02T17:44:40Z")

</div>

I have this syslog output and am trying to parse it out:  
Login Success [user: fshearer] [Source: 10.130.129.14] [localport: 22] at 09:46:35 PDT Fri Nov 2 2018"

Grok:  
"%{NOTSPACE}%{SPACE}%{CISCO\_REASON:cisco\_reason}%{SYSLOG5424SD:user}%{SPACE}%{SYSLOG5424SD:source\_ip}%{SPACE}%{SYSLOG5424SD:local\_port}%{SPACE}%{NOTSPACE}%{SPACE}%{TIME:time}%{SPACE}%{TZ:time\_zone}%{SPACE}%{CISCO\_REASON:date}%{NOTSPACE}"

it gives me this in logstash:  
"token" =\> "YgrLvkLORuxkDCmObbnhjxGAeVYutPKg",  
"facility\_full" =\> "Secure login",  
"severity\_level" =\> "5 - Notification",  
"user" =\> "[user: fshearer]",  
"@timestamp" =\> 2018-11-02T16:46:35.448Z,  
"host" =\> "10.130.1.55",  
"log\_sequence" =\> "99598",  
"facility" =\> "SEC\_LOGIN",  
"source\_ip" =\> "[Source: 10.130.129.14]",  
"message" =\> "Login Success [user: fshearer] [Source: 10.130.129.14] [localport: 22] at 09:46:35 PDT Fri Nov 2 2018",  
"local\_port" =\> "[localport: 22]",  
"time" =\> "09:46:35",  
"date" =\> "Fri Nov 2 ",  
"facility\_mnemonic" =\> "LOGIN\_SUCCESS",  
"time\_zone" =\> "PDT",  
"tags" =\> [  
[0] "Cisco\_IOS",  
[1] "logon\_success",  
[2] "cisco-ios"  
],  
"log\_date" =\> "Nov 2 16:46:35.448 UTC",  
"cisco\_reason" =\> "Success "  
}

I am trying to get the following:  
"user" =\> "fshearer" not "[user: fshearer]"  
"source\_ip" =\> "10.130.129.14" not "[Source: 10.130.129.14]"

Can someone point me in the right direction? Thanks

---

<div class="post-metadata">

**Author:** ![Frank\_Shearer](https://avatars.discourse-cdn.com/v4/letter/f/45deac/32.png) [@Frank\_Shearer](https://discuss.elastic.co/u/Frank_Shearer)\
**Post date:** [November 2, 2018, 6:29pm UTC](https://discuss.elastic.co/t/help-with-my-grok-statement/155215/2 "2018-11-02T18:29:10Z")

</div>

Nevermind figured it out. Thanks

%{CISCO\_REASON}%{SYSLOG5424PRINTASCII}%{SPACE}%{USER}%{SYSLOG5424PRINTASCII}%{SPACE}%{SYSLOG5424PRINTASCII}%{SPACE}%{IP}%{SYSLOG5424PRINTASCII}%{SPACE}%{SYSLOG5424PRINTASCII}%{SPACE}%{INT}%{SYSLOG5424PRINTASCII}%{SPACE}%{WORD}%{SPACE}%{TIME}%{SPACE}%{TZ}%{SPACE}%{DAY}%{SPACE}%{MONTH}%{SPACE}%{MONTHDAY}%{SPACE}%{YEAR}

But I have noticed on the failed logins the log doesnt add a user name Login failed [user:], how would I handle a empty space? %{USER:user}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2018, 6:29pm UTC](https://discuss.elastic.co/t/help-with-my-grok-statement/155215/3 "2018-11-30T18:29:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.