# How filter OpenLDAP Logs?

**URL:** <https://discuss.elastic.co/t/how-filter-openldap-logs/2492>\
**Category:** Logstash\
**Created:** [June 11, 2015, 3:54pm UTC](https://discuss.elastic.co/t/how-filter-openldap-logs/2492 "2015-06-11T15:54:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gqs](https://avatars.discourse-cdn.com/v4/letter/g/3be4f8/32.png) [@gqs](https://discuss.elastic.co/u/gqs)\
**Post date:** [June 11, 2015, 3:54pm UTC](https://discuss.elastic.co/t/how-filter-openldap-logs/2492/1 "2015-06-11T15:54:23Z")

</div>

Hi,

Attempting to parse LDAP access logs (sample below):

- required to be able to find transactions by 'conn' (to relate the IP Address to a BIND) for example.

Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 fd=28 ACCEPT from IP=1.2.3.4:57632 (IP=0.0.0.0:389)  
Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 op=0 BIND dn="cn=User,c=corp" method=128  
Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 op=0 BIND dn="cn=User,c=corp" mech=SIMPLE ssf=0  
Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 op=0 RESULT tag=97 err=0 text=  
Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 op=1 SRCH base="c=fr" scope=0 deref=2 filter="(objectClass=\*)"  
Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 op=1 SRCH attr=contextCSN  
Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=  
Jun 11 09:53:08 ldapserver slapd[19329]: conn=1202229 fd=28 closed (connection lost)

Any tips on how to get this going?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 11, 2015, 5:51pm UTC](https://discuss.elastic.co/t/how-filter-openldap-logs/2492/2 "2015-06-11T17:51:18Z")

</div>

It looks like a syslog file so you should be able to use one of the standard patterns for that, and then you can just continue with the rest of what you want to match. You'll probably want one pattern per type of log entry. The [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) will try them one by one and pick the first match. Untested but should get you started:

```
filter {
  grok {
    match => {
      "message" => [
        "%{SYSLOGBASE} conn=%{INT:conn} fd=%{INT:fd} ACCEPT from IP=%{IP:client_ip}:%{INT:client_port} (IP=%{IP:local_ip}:%{INT:local_port})",
        "%{SYSLOGBASE} conn=%{INT:conn} op=%{INT:op} BIND ...",
        ...
      ]
    }
  }
}

```

For some of these messages you could save some grok-writing effort by using the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) (since they're space-separated lists of key=value tokens), but then you'd have to extract that part of the message into a separate field and run _that_ field through kv, which might be more work than necessary.

---

<div class="post-metadata">

**Author:** ![gqs](https://avatars.discourse-cdn.com/v4/letter/g/3be4f8/32.png) [@gqs](https://discuss.elastic.co/u/gqs)\
**Post date:** [June 12, 2015, 1:17pm UTC](https://discuss.elastic.co/t/how-filter-openldap-logs/2492/3 "2015-06-12T13:17:49Z")

</div>

Thanks B.

I'll try that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/how-filter-openldap-logs/2492/4 "2017-07-06T05:37:34Z")

</div>