# Issues in parsing baracuda firewall

**URL:** <https://discuss.elastic.co/t/issues-in-parsing-baracuda-firewall/144244>\
**Category:** Logstash\
**Created:** [August 13, 2018, 9:24pm UTC](https://discuss.elastic.co/t/issues-in-parsing-baracuda-firewall/144244 "2018-08-13T21:24:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)\
**Post date:** [August 13, 2018, 9:24pm UTC](https://discuss.elastic.co/t/issues-in-parsing-baracuda-firewall/144244/1 "2018-08-13T21:24:10Z")

</div>

I am trying to parse Baracuda Web Filter and I am having compile error.

Here is the log  
2018-08-07 11:00:01||1||5||bwf||192.168.6.141 - - [07/Aug/2018:11:00:00 -0700] "CONNECT [store-images.s-microsoft.com:443](http://store-images.s-microsoft.com:443) HTTP/1.0" 407 15530 TCP\_DENIED:HIER\_NONE  
2018-08-07 11:00:01||1||5||bwf||192.168.6.141 - - [07/Aug/2018:11:00:00 -0700] "CONNECT [store-images.s-microsoft.com:443](http://store-images.s-microsoft.com:443) HTTP/1.0" 407 15530 TCP\_DENIED:HIER\_NONE  
2018-08-07 11:00:01||1||5||bwf||192.168.6.141 - - [07/Aug/2018:11:00:00 -0700] "CONNECT [store-images.s-microsoft.com:443](http://store-images.s-microsoft.com:443) HTTP/1.0" 407 15530 TCP\_DENIED:HIER\_NONE

and here is the code

```
input {
  file {
    path => "/Users/samvidkulkarni/report2.txt"
    type => "syslog"
    start_position => beginning
    ignore_older => 0

  }
  }
filter {
    # Split the syslog part and Cisco tag out of the message
    grok {
      match => ["message", "%{TIMESTAMP_ISO8601:timestamp}\|\|%{NUMBER:syslog_cat}\|\|%{NUMBER:syslog_severity}\|\|%{WORD:firewall}\|\|%{IP:src} -- [%{TIMESTAMP_ISO8601:timestamp2}] "%{WORD:action} %{URL:uri}:%{NUMBER:port} HTTP/1.0" %{NUMBER:status} %{NUMBER:port} %{WORD:action}:%{WORD:action2}"]
    }

    # Parse the syslog severity and facility
    syslog_pri { }

    # Parse the date from the "timestamp" field to the "@timestamp" field
    date {
      match => ["timestamp", "yyyy-MM-dd HH:mm:ss"
      ]
      timezone => "UTC"
    }

    date{
    match => ["timestamp2", "dd/MMM/YYYY HH:mm:ss Z"] timezone => "UTC"
    }

    # Clean up redundant fields if parsing was successful
    if "_grokparsefailure" not in [tags] {
      mutate {
        rename => ["cisco_message", "message"]
        remove_field => ["timestamp"]
      }
      }
    
  
}
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

```

the issue is somewhere in the regex but i am not able to understand whats the issue. i tried on [http://grokconstructor.appspot.com/do/match#result](http://grokconstructor.appspot.com/do/match#result) but it says compile error and below is the error

```
Syntax error in the given pattern %{TIMESTAMP_ISO8601:timestamp}\|\|%{NUMBER:syslog_cat}\|\|%{NUMBER:syslog_severity}\|\|%{WORD:firewall}\|\|%{IP:src} -- [%{TIMESTAMP_ISO8601:timestamp2}] "%{WORD:action} %{URIPATH:uri}:%{NUMBER:port} HTTP/1.0" %{NUMBER:status} %{NUMBER:port} %{WORD:action}:%{WORD:action2} : 
empty range in char class
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 14, 2018, 12:16am UTC](https://discuss.elastic.co/t/issues-in-parsing-baracuda-firewall/144244/2 "2018-08-14T00:16:35Z")

</div>

> [@Samvid\_Kulkarni](#):
>
> ```
> match => ["message", "%{TIMESTAMP_ISO8601:timestamp}\|\|%{NUMBER:syslog_cat}\|\|%{NUMBER:syslog_severity}\|\|%{WORD:firewall}\|\|%{IP:src} -- [%{TIMESTAMP_ISO8601:timestamp2}] "%{WORD:action} %{URL:uri}:%{NUMBER:port} HTTP/1.0" %{NUMBER:status} %{NUMBER:port} %{WORD:action}:%{WORD:action2}"] }
> 
> ```

You need to escape the around the second timestamp, and the double quotes around the HTTP request, and the pattern is called URI, not URL.

---

<div class="post-metadata">

**Author:** ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)\
**Post date:** [August 14, 2018, 4:57pm UTC](https://discuss.elastic.co/t/issues-in-parsing-baracuda-firewall/144244/3 "2018-08-14T16:57:19Z")

</div>

thank you very much. issue solved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2018, 4:57pm UTC](https://discuss.elastic.co/t/issues-in-parsing-baracuda-firewall/144244/4 "2018-09-11T16:57:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.