# Log between {}

**URL:** <https://discuss.elastic.co/t/log-between/127325>\
**Category:** Logstash\
**Created:** [April 9, 2018, 1:11pm UTC](https://discuss.elastic.co/t/log-between/127325 "2018-04-09T13:11:25Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\
**Post date:** [April 9, 2018, 1:11pm UTC](https://discuss.elastic.co/t/log-between/127325/1 "2018-04-09T13:11:25Z")

</div>

Hello, i am having my log between brackets and i am not able to parse that part, can anyone help me??

Regards

my log is [Priority: 2] {TCP} 192.168.16.247:51650 -\> 52.184.227.73:443

i was able to parse the priority, but i am not able to parse de TCP part that is between {}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 1:23pm UTC](https://discuss.elastic.co/t/log-between/127325/2 "2018-04-09T13:23:32Z")

</div>

What does your configuration look like?

---

<div class="post-metadata">

**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\
**Post date:** [April 9, 2018, 1:40pm UTC](https://discuss.elastic.co/t/log-between/127325/3 "2018-04-09T13:40:32Z")

</div>

my entire log is  
Mar 23 11:46:27 CLL21DCIDS01-IDS snort[26109]: [137:1:2] (spp\_ssl) Invalid CHELLO after Server HELLO Detected [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.17.11:52259 -\> 104.40.28.30:443

and my config is

filter {  
grok{  
match =\> {"message"=\>"%{SYSLOGTIMESTAMP:logDate} %{NOTSPACE:hostname} %{NOTSPACE:loglevel} [%{NOTSPACE:mynumber}] (%{NOTSPACE:otraVariable}) %{DATA:message}Priority: %{INT:priority}] %{IP:sourceIp} : "}  
overwrite =\> ["message"]  
}  
mutate {  
copy =\> { "loglevel" =\> "loglevel\_tmp" }  
}  
mutate {  
split =\> ["loglevel\_tmp", "["]  
add\_field =\> { "hostType" =\> "%{loglevel\_tmp[0]}" }  
add\_field =\> { "ruleId" =\> "%{loglevel\_tmp[1]}" }  
}  
mutate{  
remove\_field =\> ["loglevel\_tmp","loglevel"]  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 1:59pm UTC](https://discuss.elastic.co/t/log-between/127325/4 "2018-04-09T13:59:01Z")

</div>

Always post your configuration as preformatted text so it doesn't get mangled.

Keep in mind that braces and brackets have special meaning in regular expressions (and therefore grok expressions) so you need to escape them if you want their literal meaning.

---

<div class="post-metadata">

**Author:** ![Sebastian\_Herrera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastian_herrera/32/53209_2.png) [@Sebastian\_Herrera](https://discuss.elastic.co/u/Sebastian_Herrera)\
**Post date:** [April 9, 2018, 4:33pm UTC](https://discuss.elastic.co/t/log-between/127325/5 "2018-04-09T16:33:25Z")

</div>

> [@magnusbaeck](#):
>
> them if you want their literal meaning.

yeap i figured it out 🙂 it was my bad. thanks fro helping.

One more question, i am using geoIp, but source and destination ip, only one is public. i there any way to check if the ip is public?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 9, 2018, 8:20pm UTC](https://discuss.elastic.co/t/log-between/127325/6 "2018-04-09T20:20:25Z")

</div>

> i there any way to check if the ip is public?

Use a cidr filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2018, 8:20pm UTC](https://discuss.elastic.co/t/log-between/127325/7 "2018-05-07T20:20:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.