# How to Logstash gork filter with different infos in syslog message field
**URL:** https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078
**Category:** Logstash
**Created:** [March 8, 2018, 1:30pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078 "2018-03-08T13:30:13Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@jiona](https://discuss.elastic.co/u/jiona)
#### Post date: [March 8, 2018, 1:30pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078/1 "2018-03-08T13:30:13Z")
Hi All,
I want to parse a firewall syslog stream.
Depends on firewall action the syslog message field contains additional information like the outbound interface or the service-name of well known ports or not.
I have three examples:
|10.15.40.25|443|http-s|p3|Allow-443|
|10.15.40.25|53|dns|53||BLOCKALL|
|10.15.40.25|60000|||BLOCKALL|
Do I need for each type a single gork filter (like below) and how I have to configure the gork filter finaly.
|%{IPV4:Dst-IP}|%{INT:Dst-Port}|%{USERNAME:Dst-Service}|%{WORD:Dst-Inf}|%{WORD:Rule-Name}
|%{IPV4:Dst-IP}|%{INT:Dst-Port}|%{USERNAME:Dst-Service}||%{WORD:Rule-Name}
|%{IPV4:Dst-IP}|%{INT:Dst-Port}|||%{WORD:Rule-Name}
Many thanks in advance.
Jiona
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 8, 2018, 1:50pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078/2 "2018-03-08T13:50:37Z")
A single grok filter can list multiple expressions. They will be tried in order. There's an example in the grok filter documentation.
---
### Author:  [@jiona](https://discuss.elastic.co/u/jiona)
#### Post date: [March 8, 2018, 3:40pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078/3 "2018-03-08T15:40:12Z")
Thats sounds good.
Can you share a link where I can find this information.
---
### Author:  [@jiona](https://discuss.elastic.co/u/jiona)
#### Post date: [March 8, 2018, 4:18pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078/4 "2018-03-08T16:18:51Z")
In the documentation I found following example to match multiple patterns against a single field.
filter {
grok { match =\> { "message" =\> ["Duration: %{NUMBER:duration}", "Speed: %{NUMBER:speed}"] } }
}
But I have no idea how to configure my filter based on this example.
I apologize because I'm new with gork and regex.
Jiona
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 8, 2018, 7:19pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078/5 "2018-03-08T19:19:02Z")
You already have three grok expressions. Just list them in the grok filter as in the example.
---
### Author:  [@jiona](https://discuss.elastic.co/u/jiona)
#### Post date: [March 11, 2018, 10:53pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078/6 "2018-03-11T22:53:06Z")
Thanks @magnusbaeck.
After reading some documents and testings, the following easy filter works for me (without \_grokparsefailure):
filter {
if [type] == "syslog" {
grok {
match =\> { "message" =\> "`\`|%{IPV4:Dst-IP}`\`|%{INT:Dst-Port}`\`|%{USERNAME:Dst-Service}`\`|%{WORD:Dst-Inf}`\`|%{WORD:Rule-Name}"}
match =\> { "message" =\> "`\`|%{IPV4:Dst-IP}`\`|%{INT:Dst-Port}`\`|%{USERNAME:Dst-Service}`\`|`\`|%{WORD:Rule-Name}"}
match =\> { "message" =\> "`\`|%{IPV4:Dst-IP}`\`|%{INT:Dst-Port}`\`|`\`|`\`|%{WORD:Rule-Name}"}
}
}
}
Kind regards
Jiona
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 8, 2018, 10:53pm UTC](https://discuss.elastic.co/t/how-to-logstash-gork-filter-with-different-infos-in-syslog-message-field/123078/7 "2018-04-08T22:53:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.