# Help with parsing Kaspersky logs

**URL:** <https://discuss.elastic.co/t/help-with-parsing-kaspersky-logs/115329>\
**Category:** Logstash\
**Created:** [January 12, 2018, 3:53pm UTC](https://discuss.elastic.co/t/help-with-parsing-kaspersky-logs/115329 "2018-01-12T15:53:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\
**Post date:** [January 12, 2018, 3:53pm UTC](https://discuss.elastic.co/t/help-with-parsing-kaspersky-logs/115329/1 "2018-01-12T15:53:58Z")

</div>

Not sure if this should be asked here or maybe Kibana so please let me know if this isn't the right place.....

I've written a grok pattern using [a Grok debugger tool](http://grokdebug.herokuapp.com/) and the tool gives me the proper named fields but when I add the pattern as a filter conf file in logstash its being parsed differently in Kibana. As you will see in the screenshot the Reason field is including a lot of the fields I am attempting to parse but the kvdata fields are parsing correctly.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ff0b6d31ccbbb67c6a7202769937aad4ca09a128.png)

Here is my pattern:  
filter {  
if [type] == "kaspersky-av" {  
grok {  
match =\> {"message" =\> "%{SYSLOGTIMESTAMP}\s%{IPV4:SourceIP}\s%{INT}\s%{TIMESTAMP\_ISO8601}\s%{HOSTNAME}\s%{DATA:Code}|%{GREEDYDATA:version} -\s%{USERNAME}\s[event@%{HOSTNAME}\s%{GREEDYDATA:kvdata}]\sEvent type:\s%{DATA:Event\_type}\Name:\s%{DATA:Name}\Path:\s%{GREEDYDATA:Path}\Process ID:\s%{GREEDYDATA:Process\_ID}\nUser:\s%{GREEDYDATA:User}\r\nComponent:\s%{GREEDYDATA:Component}Description:\s%{DATA:Description}Type:\s%{DATA:Type}Name:\s%{DATA:Name2}Threat level:\s%{DATA:Threat\_level}Precision:\s%{DATA:Precision}\r\nAction:\s%{DATA:Action}\r\nObject:\s%{DATA:Object}Type:\s%{DATA:Type2}Path:\s%{DATA:Path2}Name:\s%{DATA:Name3}\r\nReason:\s%{DATA:Reason}\r\n"}  
}  
kv {  
source =\> "kvdata"  
trim\_value =\> """  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\
**Post date:** [January 12, 2018, 4:22pm UTC](https://discuss.elastic.co/t/help-with-parsing-kaspersky-logs/115329/2 "2018-01-12T16:22:34Z")

</div>

I figured out my issue. This can be marked as resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2018, 4:22pm UTC](https://discuss.elastic.co/t/help-with-parsing-kaspersky-logs/115329/3 "2018-02-09T16:22:37Z")

</div>

Closed on February 9, 2018, 4:22pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.