How to get grok filter from variable


(Jon) #1

I have somewhat of a complex use case where some events have data in their firewall "msg" field that needs to be parsed out (most don't). I have a dictionary file that is parsing out just fine with the kv plugin, but am having a hard time referencing the variable in the grok filter. Can someone tell me what I'm doing wrong to reference this?

if [ec_grok] {
grok {
match => [ "event_content", "[ec_grok]"]
}
}

Note "ec_grok" is the field that has the following "%{DATA} %{IP:source_ip} %{DATA} %{MAC:srcMac}".

If needed, the full logstash config can be seen in my github:
https://github.com/JonFurmanski/logstash/blob/master/examples/sonicwall/logstash.conf


(Magnus B├Ąck) #2

Grok expressions with dynamic %{field} references aren't supported.


(Jon) #3

Thank you for the clarification. I've gone ahead an opened up a feature request in github

https://github.com/elastic/logstash/issues/9099


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.