# How to parse optional fields in dhcp lease logs?

**URL:** <https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [February 17, 2025, 5:40am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602 "2025-02-17T05:40:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kriti\_dabas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kriti_dabas/32/118506_2.png) [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\
**Post date:** [February 17, 2025, 5:40am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602/1 "2025-02-17T05:40:34Z")

</div>

I want help in parsing of optional fields

```auto
lease 1.1.1.1 {
  starts 5 2025/02/14 05:32:50;
  ends 5 2025/02/14 05:37:55;
  tstp 5 2025/02/14 05:37:55;
  cltt 5 2025/02/14 05:37:54;
  binding state free;
  hardware ethernet 58:96:71:a5:89:f4;
  uid "\001X\226q\245\211\364";
}

lease 1.1.1.1 {
  starts 5 2025/02/14 05:38:59;
  ends 0 2025/03/16 05:38:59;
  cltt 5 2025/02/14 05:38:59;
  binding state active;
  next binding state free;
  rewind binding state free;
  hardware ethernet d8:32:e3:20:0b:01;
  uid "\001\3302\343 \013\001";
  set vendor-class-identifier = "android-dhcp-9";
  client-hostname "RedmiNote5Pro-Redmi";
}

```

Following is the grok pattern in which some fields sometimes comes and sometimes doesn't come.

How to make it in a way that even if the field doesn't come other fields should still be parsed.

```auto
lease %{IP:ip_address} \{
  starts %{NUMBER} (?<starts>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND});
  ends %{NUMBER} (?<ends>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND});
  tstp %{NUMBER} (?<tstp>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND});
  cltt %{NUMBER} (?<cltt>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND});
  binding %{GREEDYDATA:binding};
  next %{GREEDYDATA:next};
  rewind %{DATA:rewind};
  hardware ethernet %{GREEDYDATA:hardware};
  uid %{GREEDYDATA:uid};
  set vendor-class-identifier = %{DATA:vendor-class-identifier};
  client-hostname %{GREEDYDATA:client-hostname};
}

```

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [February 17, 2025, 10:57am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602/2 "2025-02-17T10:57:00Z")

</div>

how is this different from the Q you already posted?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 17, 2025, 1:55pm UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602/3 "2025-02-17T13:55:40Z")

</div>

I would use grok with break\_on\_match set to false and an array of patterns like

```
'uid "(?<uid>[^;]*)";',
'ends (?<ends>[^;]*);',

```

to pull out one line at a time.

---

<div class="post-metadata">

**Author:** ![kriti\_dabas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kriti_dabas/32/118506_2.png) [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\
**Post date:** [February 18, 2025, 6:05am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602/4 "2025-02-18T06:05:07Z")

</div>

both are same

---

<div class="post-metadata">

**Author:** ![kriti\_dabas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kriti_dabas/32/118506_2.png) [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\
**Post date:** [February 18, 2025, 9:52am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602/5 "2025-02-18T09:52:58Z")

</div>

not working

---

<div class="post-metadata">

**Author:** ![kriti\_dabas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kriti_dabas/32/118506_2.png) [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\
**Post date:** [February 19, 2025, 10:47am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602/6 "2025-02-19T10:47:32Z")

</div>

suggest something else