# How to parse bluecoat proxyAV logs

**URL:** <https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520>\
**Category:** Logstash\
**Created:** [October 2, 2015, 5:26am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520 "2015-10-02T05:26:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![riconeo](https://avatars.discourse-cdn.com/v4/letter/r/5daacb/32.png) [@riconeo](https://discuss.elastic.co/u/riconeo)\
**Post date:** [October 2, 2015, 5:26am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520/1 "2015-10-02T05:26:25Z")

</div>

Format string from Bluecoat ProxyAV  
c-dns, -, -, N, date, time, 1, -, -, s-dns, s-ip, s-port, time-taken, sc-bytes, cs-bytes, cs-protocol, -, cs-method, cs-uri, sc-mimetype, cache, sc-status

Output in the logstash message  
192.1.1.1, -, -, N, 2015-10-02, 13:23:22, 1, -, -, ProxyAV01, 192.2.1.1, 1344, 31500, 224, 0, ICAP, -, RESPMOD, [http://www.cnet.com](http://www.cnet.com), -, Inet, 204

How can i parse the message into a more searchable and readable fields into logstash?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 2, 2015, 5:34am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520/2 "2015-10-02T05:34:24Z")

</div>

This is a good match for the [csv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html). The columns containing numerical data won't be converted to integer fields so you'll want to do that afterwards with a [mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html).

Make sure you understand what happens if a field value contains a comma. This can e.g. happen with the cs-uri field. If you set the csv filter's separator to ", " (comma space) you should be fine but I'd make sure there aren't any corner cases.

---

<div class="post-metadata">

**Author:** ![riconeo](https://avatars.discourse-cdn.com/v4/letter/r/5daacb/32.png) [@riconeo](https://discuss.elastic.co/u/riconeo)\
**Post date:** [October 2, 2015, 6:36am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520/3 "2015-10-02T06:36:51Z")

</div>

is this the way to do it?

filter {

csv {

```
columns => ["c-dns", "date", "time", "s-dns", "s-ip", "s-port", "time-taken", "sc-bytes", "cs-bytes", "cs-protocol", "cs-method", "cs-uri", "sc-mimetype", "cache", "sc-status"]
separator => ","

}
grok {
        match => ["message","%{IP:c-dns} %{DATESTAMP:date} %{DATESTAMP:time} %{WORD:s-dns} %{IP:s-ip} %{NUMBER:s-port} %{NUMBER:time-taken} %{NUMBER:sc-bytes} %{NUMBER:cs-bytes} %{WORD:cs-protocoal} %{WORD:cs-method} %{URIPATHPARAM:cs-uril} %{WORD:cs-mimetype} %{WORD:cache} %{NUMBER:sc-status}"]
}

```

}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 2, 2015, 7:10am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520/4 "2015-10-02T07:10:02Z")

</div>

Well, why don't you try it out?

But drop the grok filter. It duplicates the job of the csv filter (plus the expression won't match anything since you've omitted the commas). Also, as I suggested, make the csv filter's separator ", " (comma space) instead of just a comma.

Or, use the grok filter instead of the csv filter. Properly configured either will work. The benefit of the grok filter is that it's easier to deal with corner cases and you can capture integer fields right away without needing a follow-up mutate filter to convert some of the strings to integers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520/5 "2017-07-06T05:27:30Z")

</div>

Closed on July 6, 2017, 5:27am UTC