# How to replace grok pattern with new name

**URL:** <https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715>\
**Category:** Logstash\
**Created:** [September 15, 2018, 4:53pm UTC](https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715 "2018-09-15T16:53:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\
**Post date:** [September 15, 2018, 4:53pm UTC](https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715/1 "2018-09-15T16:53:23Z")

</div>

below example --

May be i have given wrong subject : but what iam looking example as below :

First example is my netscaler log and second one is switch log

Switch log syslog message ok.  
But netscalar log i get as netscaler\_message, how can i rename or replace with syslog\_message,

since i have many matching i need to only replace netscaler, and remain rest, any assitance will be appricated.

FROM to TO as below

**netscaler\_message** to **syslog\_message**

Sep 14 22:36:13 NET-VPX02 09/14/2018:21:36:13 GMT NET-VPX02 0-PPE-0 : default SSLLOG SSL\_HANDSHAKE\_SUCCESS 718118 0 : SPCBId 385274 - ClientIP 192.168.255.47 - ClientPort 30850 - VserverServiceIP 192.168.255.55 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "AES-256-CBC-SHA TLSv1.2 Non-Export 256-bit" - Session New - HandshakeTime 2 ms  
Sep 14 22:36:11 SWITCH01 9120576: Sep 14 22:36:10.460 BST: %SEC-6-IPACCESSLOGP: list test-in denied tcp 192.168.251.11(65009) -\> 10.188.251.254(9100), 5 packets

# Grok Pattern

match =\> [  
"message", "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME:device\_src} %{NUMBER} %{SYSLOGTIMESTAMP} %{WORD}: %{GREEDYDATA:syslog\_message}",  
"message", "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME:device\_src} %{GREEDYDATA:syslog\_message}",  
"message", "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME:device\_src} %{NUMBER}: %{SYSLOGTIMESTAMP} %{WORD}: %{GREEDYDATA:syslog\_message}",  
"message", "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME:device\_src} %{DATE\_US}:%{TIME} GMT %{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:netscaler\_message}"  
]

# Structured Data

{  
"syslog\_hostname": "NET-VPX02",  
"syslog\_timestamp": "Sep 14 22:36:13",  
" **netscaler\_message**": "0-PPE-0 : default SSLLOG SSL\_HANDSHAKE\_SUCCESS 718118 0 : SPCBId 385274 - ClientIP 192.168.255.47 - ClientPort 30850 - VserverServiceIP 192.168.255.55 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "AES-256-CBC-SHA TLSv1.2 Non-Export 256-bit" - Session New - HandshakeTime 2",  
"device\_src": "NET-VPX02"  
}

{  
"syslog\_timestamp": "Sep 14 22:36:11",  
"syslog\_message": "%SEC-6-IPACCESSLOGP: list test-in denied tcp 192.168.251.11(65009) -\> 10.188.251.254(9100), 5 packets",  
"device\_src": "SWITCH01"  
}

---

<div class="post-metadata">

**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\
**Post date:** [September 15, 2018, 7:09pm UTC](https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715/2 "2018-09-15T19:09:16Z")

</div>

not sure is this correct way to do it, But i can see the results it was renamed as expected.

rename is good or replace ?

mutate {  
rename =\> { "netscaler\_message" =\> "syslog\_message" }  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2018, 7:25pm UTC](https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715/3 "2018-09-15T19:25:05Z")

</div>

Why do you not simply change the name of the captured field in the last grok expression?

---

<div class="post-metadata">

**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\
**Post date:** [September 15, 2018, 8:05pm UTC](https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715/4 "2018-09-15T20:05:19Z")

</div>

> [@ramindia](#):
>
> %{GREEDYDATA:netscaler\_message}"

is this one you mean ?

if i change that one, i get different data output.

---

<div class="post-metadata">

**Author:** ![ramindia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramindia/32/32459_2.png) [@ramindia](https://discuss.elastic.co/u/ramindia)\
**Post date:** [September 15, 2018, 8:09pm UTC](https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715/5 "2018-09-15T20:09:08Z")

</div>

You right, it works, may be i got different output before i guess..  
thanks for the input.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2018, 8:09pm UTC](https://discuss.elastic.co/t/how-to-replace-grok-pattern-with-new-name/148715/6 "2018-10-13T20:09:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.