# How to find filter for this? **URL:** \ **Category:** Logstash\ **Created:** [April 25, 2018, 5:51am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410 "2018-04-25T05:51:23Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![SashaAlex](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@SashaAlex](https://discuss.elastic.co/u/SashaAlex)\ **Post date:** [April 25, 2018, 5:51am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/1 "2018-04-25T05:51:23Z")
I have following log message.I don't have any idea how I use logstash filter for this message.can some one help me? Apr 25 05:09:47 52.78.111.182 %DEVICE-6-UNADOPTED: Device('ap3222-E6D67E'/'ap7622'/74-57-F7-E6-D4-7E) at rf-domain:'ABC-SL' unadopted. Radios: Count=2, Bss: 74-57-F7-DD-E5-20|74-67-F7-DD-E5-42| ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 25, 2018, 5:59am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/2 "2018-04-25T05:59:33Z")
Have you tried using the grok constructor web site to craft a grok expression? It's also not clear what the desired result is. Do you want to extract any fields besides the timestamp and the IP address? Do all your messages look like this or are there variations to take into account? ---
**Author:** ![SashaAlex](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@SashaAlex](https://discuss.elastic.co/u/SashaAlex)\ **Post date:** [April 25, 2018, 6:04am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/3 "2018-04-25T06:04:51Z")
all messages are look like this. I want to extract time field, status(adopted or unadopted), device name, device mac and rf-domain from this message. I tried use to grok. But this message is different than usual messages. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 25, 2018, 6:27am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/4 "2018-04-25T06:27:21Z")
> I tried use to grok. But this message is different than usual messages. Not sure what you mean by this. With some help from the grok constructor site it should be easy to cook a reasonably good expression. ---
**Author:** ![SashaAlex](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@SashaAlex](https://discuss.elastic.co/u/SashaAlex)\ **Post date:** [April 25, 2018, 9:39am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/5 "2018-04-25T09:39:53Z")
I tried following grok pattern. %{CISCOTIMESTAMP:ciscotimestamp} %{IP:serverip} %{SYSLOGPROG}: %{GREEDYDATA:message} but I want to extract this GREEDYDATA field also. how can I do this? Please helpme ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [April 25, 2018, 10:56am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/6 "2018-04-25T10:56:42Z")
The GREEDYDATA expression captures the following: ``` "Device('ap3222-E6D67E'/'ap7622'/74-57-F7-E6-D4-7E) at rf-domain:'ABC-SL' unadopted. Radios: Count=2, Bss: 74-57-F7-DD-E5-20|74-67-F7-DD-E5-42|" ``` What specifically do you wish to capture in this? ---
**Author:** ![SashaAlex](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@SashaAlex](https://discuss.elastic.co/u/SashaAlex)\ **Post date:** [April 25, 2018, 11:01am UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/7 "2018-04-25T11:01:16Z")
devicename - ap3222-E6D67E device - ap7622 devicemac - 74-57-F7-E6-D4-7E likewise I want to get that data. I created following pattern. %{CISCOTIMESTAMP:ciscotimestamp} %{IP:serverip} %{SYSLOGPROG}: \bDevice(?'devicename'[^'][^/]_)[^']_(?'device'[^'][^/]_)(?'devicemac'[^'][^/][^)]_) but it gives , |program |%DEVICE-6-UNADOPTED| |devicemac |/74-57-F7-E6-D4-7E| |ciscotimestamp |Apr·25·05:09:47| |devicename |('ap3222-E6D67E'| |serverip |52.78.111.182| |device |/'ap7622'| I want to remove /, ', ( from above 3 values (devicename,device and devicemac) ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [April 25, 2018, 12:22pm UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/8 "2018-04-25T12:22:20Z")
Here is a sample pattern that could be written. This assumes that the pattern remains consistent across the log lines. Custom Pattern used is as follows: `CPAT ([\w-]+)` Here is the complete expression: `%{CISCOTIMESTAMP:ciscotimestamp} %{IP:serverip} %{SYSLOGPROG}: Device\(\'%{CPAT:devicename}\'\/\'%{CPAT:device}\'\/%{CPAT:devicemac}` I have used the Grok Debugger included with Kibana to write this pattern. ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef72d9f9d0dc2accff1b9e7209c6e868a4e268a3.png) Let me know if this helps! ---
**Author:** ![SashaAlex](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@SashaAlex](https://discuss.elastic.co/u/SashaAlex)\ **Post date:** [April 25, 2018, 12:26pm UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/9 "2018-04-25T12:26:24Z")
> [@NerdSec](#): > > CPAT ([\w-]+) Thank you so much it works ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 23, 2018, 12:26pm UTC](https://discuss.elastic.co/t/how-to-find-filter-for-this/129410/10 "2018-05-23T12:26:28Z")
Closed on May 23, 2018, 12:26pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.