# Help with parsing similar bit in a message

**URL:** <https://discuss.elastic.co/t/help-with-parsing-similar-bit-in-a-message/231737>\
**Category:** Logstash\
**Created:** [May 8, 2020, 1:45pm UTC](https://discuss.elastic.co/t/help-with-parsing-similar-bit-in-a-message/231737 "2020-05-08T13:45:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SigmazGFX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sigmazgfx/32/53534_2.png) [@SigmazGFX](https://discuss.elastic.co/u/SigmazGFX)\
**Post date:** [May 8, 2020, 1:45pm UTC](https://discuss.elastic.co/t/help-with-parsing-similar-bit-in-a-message/231737/1 "2020-05-08T13:45:11Z")

</div>

Hey gang. I'm trying to set up GEOIP and I need to pick out he client IP from the message string. problem is that I need the client IP and while I think my patch would work, Im afraid it'll freak out when it sees the second client IP column.  
Here, take a look at part of the message:  
[security2:error] [pid 18559:tid 140351285200640] [client 123.123.123.123:54654] [client 123.123.123.123] ModSecurity: Warning. Match of "within %{tx.allowed\_methods}" against "REQUEST\_METHOD" required. [file "/content/waf/2.7.3/modsecurity\_crs\_http\_policy.conf"] [line "31"] [id.....

I'm thinking of matching and extracting the client IP like this

`if [message] =~ "\[client " { grok { match => { "message" => "\[client \"%{DATA:srcip}:srcport\"%{DATA:srcport}\"\]" }}}`

will this work or whats a better way to take into account the second instance without blowing up.

Thanks!!  
-jon

---

<div class="post-metadata">

**Author:** ![SigmazGFX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sigmazgfx/32/53534_2.png) [@SigmazGFX](https://discuss.elastic.co/u/SigmazGFX)\
**Post date:** [May 8, 2020, 3:46pm UTC](https://discuss.elastic.co/t/help-with-parsing-similar-bit-in-a-message/231737/2 "2020-05-08T15:46:16Z")

</div>

I think I may have figured it out. I'm just waiting now for some data to come in to verify.  
Does this seem correct?

```auto
if [message] =~ "\[client " { 
		grok { match => { "message" => [
			"\[client %{DATA:client}\] \[client %{DATA:srcip}\]",
			"\[client %{DATA:srcip}\]"
		]} } }

```

srcip being the variable I'm sng off to geoid.  
Thanks  
-jon

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2020, 3:46pm UTC](https://discuss.elastic.co/t/help-with-parsing-similar-bit-in-a-message/231737/3 "2020-06-05T15:46:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.