# How to parse the mod security log.. plz help **URL:** \ **Category:** Logstash\ **Created:** [December 16, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-parse-the-mod-security-log-plz-help/258869 "2020-12-16T13:58:38Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![sujeetjha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sujeetjha/32/79402_2.png) [@sujeetjha](https://discuss.elastic.co/u/sujeetjha)\ **Post date:** [December 16, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-parse-the-mod-security-log-plz-help/258869/1 "2020-12-16T13:58:38Z")
hey i want to parse mod\_security log using logstash. when i have checked the logstash it is working fine. ```auto logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2020-12-16 13:47:10 UTC; 8min ago Main PID: 439976 (java) Tasks: 34 (limit: 4710) Memory: 581.2M CGroup: /system.slice/logstash.service └─439976 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+U> Dec 16 13:47:35 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:35,439][INFO][logstash.outputs.elasticsearch][main] New Elasticsearc> Dec 16 13:47:35 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:35,517][INFO][logstash.outputs.elasticsearch][main] Using a default > Dec 16 13:47:35 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:35,620][INFO][logstash.outputs.elasticsearch][main] Attempting to in> Dec 16 13:47:35 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:35,858][INFO][logstash.javapipeline][main] Starting pipeline {:p> Dec 16 13:47:37 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:37,688][INFO][logstash.javapipeline][main] Pipeline Java executi> Dec 16 13:47:37 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:37,934][INFO][logstash.inputs.file][main] No sincedb_path set, > Dec 16 13:47:37 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:37,962][INFO][logstash.javapipeline][main] Pipeline started {"pi> Dec 16 13:47:38 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:38,024][INFO][logstash.agent] Pipelines running {:count=>> Dec 16 13:47:38 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:38,061][INFO][filewatch.observingtail][main][33f4c5ed2f5da08dc2c60> Dec 16 13:47:38 ip-172-31-11-54 logstash[439976]: [2020-12-16T13:47:38,408][INFO][logstash.agent] Successfully started Logsta> ~ ``` this is filter/configuration file i am using right now plz show me where i have to do the modification in this file.. ```auto log of logstash :- y=>:disabled} [2020-12-16T13:47:35,620][INFO][logstash.outputs.elasticsearch][main] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}} [2020-12-16T13:47:35,858][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>250, "pipeline.sources"=>["/etc/logstash/conf.d/0000_header.conf", "/etc/logstash/conf.d/1000_input_stdin_example.conf", "/etc/logstash/conf.d/2000_filter_sections_split.conf", "/etc/logstash/conf.d/2010_filter_section_a_parse.conf", "/etc/logstash/conf.d/2020_filter_section_b_parse_request_line.conf", "/etc/logstash/conf.d/2021_filter_section_b_headers_key-value.conf", "/etc/logstash/conf.d/2030_filter_section_c_parse.conf", "/etc/logstash/conf.d/2060_filter_section_f_parse_request_line.conf", "/etc/logstash/conf.d/2061_filter_section_f_parse_headers.conf", "/etc/logstash/conf.d/2062_filter_section_f_headers_key-value.conf", "/etc/logstash/conf.d/2080_filter_section_h_parse_messages_to_auditLogTrailerMessages.conf", "/etc/logstash/conf.d/2081_filter_section_h_convert_to_key-value.conf", "/etc/logstash/conf.d/2082_filter_section_h_extract_stopwatch.conf", "/etc/logstash/conf.d/2110_filter_section_k_parse_matchedRules.conf", "/etc/logstash/conf.d/2500_filter_cleanup.conf", "/etc/logstash/conf.d/3000_output_stdout_example.conf"], :thread=>"#"} [2020-12-16T13:47:37,688][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>1.82} [2020-12-16T13:47:37,934][INFO][logstash.inputs.file][main] No sincedb_path set, generating one based on the "path" setting {:sincedb_path=>"/var/lib/logstash/plugins/inputs/file/.sincedb_d93f7c914e44f33a906e09781c1ec728", :path=>["/home/ubuntu/logs/*.log"]} [2020-12-16T13:47:37,962][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"} [2020-12-16T13:47:38,024][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]} [2020-12-16T13:47:38,061][INFO][filewatch.observingtail][main][33f4c5ed2f5da08dc2c60137eb619b53d3659a66fec98babc5b238fb7ac3d47b] START, creating Discoverer, Watch with file and sincedb collections [2020-12-16T13:47:38,408][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} ``` > **[bitsofinfo/logstash-modsecurity](https://github.com/bitsofinfo/logstash-modsecurity)** > > Logstash configuration filter set framework to parse modsecurity audit logs ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 13, 2021, 1:59pm UTC](https://discuss.elastic.co/t/how-to-parse-the-mod-security-log-plz-help/258869/2 "2021-01-13T13:59:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.