# Logstash custom pattern not working
**URL:** https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685
**Category:** Logstash
**Created:** [September 16, 2019, 3:02pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685 "2019-09-16T15:02:20Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@user3](https://discuss.elastic.co/u/user3)
#### Post date: [September 16, 2019, 3:02pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685/1 "2019-09-16T15:02:20Z")
Hello everyone,
New to logstash so please bare with me. My logstash config is not working as desired with a pattern file using regex to pull for very specific text from a log message.
From the specific log message, here is the string that I am trying to pull out as is exactly:
"dest\_port":21,"
And here is my filter:
if "xxxx" in [tags] {
grok {
patterns\_dir =\> ["./patterns"]
match =\> { "message" =\> "%{FTP:ftp}" }
add\_tag =\> "FTP"
}
}
Here is the output from my pattern file:
/patterns # more extra
FTP \<\< " \>\>\<\< d \>\>\<\< e \>\>\<\< s \>\>\<\< t \>\>\<\< \_ \>\>\<\< p \>\>\<\< o \>\>\<\< r \>\>\<\< t \>\>\<\< " \>\>\<\< : \>\>\<\< 2 \>\>\<\< 1 \>\>\<\< , \>\>\<\< " \>\>
All running in docker.
Any help would be very very much appreciated.
Thank you-
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 16, 2019, 3:20pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685/2 "2019-09-16T15:20:25Z")
If you want to test whether the [message] field contains that string then why not test it directly
```
if '"dest_port":21,"' in [message] { ... }
```
---
### Author:  [@user3](https://discuss.elastic.co/u/user3)
#### Post date: [September 16, 2019, 4:28pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685/3 "2019-09-16T16:28:52Z")
Thank you for the reply, really appreciate it. Still no joy..
Here is my current config based on your feedback:
if '"dest\_port": 21,' in [message] {
mutate {
add\_tag =\> ["FTP"]
}
}
JSON shows an extra space before 21.
At a loss at the moment.
Cheers-
---
### Author:  [@user3](https://discuss.elastic.co/u/user3)
#### Post date: [September 16, 2019, 6:06pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685/4 "2019-09-16T18:06:59Z")
At this point, I will accept any alternative solution. My end state objective it to tag this specific data from a log file as input for further processing during output using a filter..
here is a sample raw log:
{"timestamp":"2019-09-16T18:02:49.589089+0000","flow\_id":2139429747809040,"in\_iface":"ens192","event\_type":"alert","src\_ip":"192.168.1.1","src\_port":54994,"dest\_ip":"192.168.1.210","dest\_port":21,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature\_id":2010736,"rev":2,"signature":"ET FTP FTP RETR command attempt without login","category":"Attempted Information Leak","severity":2,"metadata":{"updated\_at":["2010\_07\_30"],"created\_at":["2010\_07\_30"]}},"app\_proto":"failed","flow":{"pkts\_toserver":16,"pkts\_toclient":18,"bytes\_toserver":1030,"bytes\_toclient":1188,"start":"2019-09-16T18:02:11.711440+0000"},"payload":"T1BUUyBVVEY4IE9ODQpVU0VSIGtpdGthdA0KUEFTUyBraXRrYXQNClBPUlQgMTAsNTAsNTAsMSwyNDUsNTINClJFVFIgKi5leGUNClBPUlQgMTAsNTAsNTAsMSwyNDUsNTMNClFVSVQNCg==","payload\_printable":"OPTS UTF8 ON\r\nUSER kitkat\r\nPASS kitkat\r\nPORT 192,168,1,1,245,52\r\nRETR \*.exe\r\nPORT 192,168,1,1,245,53\r\nQUIT\r\n","stream":1}
Cheers-
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 16, 2019, 6:38pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685/5 "2019-09-16T18:38:07Z")
If you have JSON data coming in I would parse it
```
filter { json { source => "message" remove_field => ["message"] } }
```
then you can use
```
if [dest_port] == 21 {
```
(or maybe use a translate filter to do a lookup).
---
### Author:  [@user3](https://discuss.elastic.co/u/user3)
#### Post date: [September 16, 2019, 8:06pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685/6 "2019-09-16T20:06:22Z")
Awesome! That worked. Thank you very much; your a lifesaver! 😉
Appreciate the help.
Cheers-
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 14, 2019, 8:06pm UTC](https://discuss.elastic.co/t/logstash-custom-pattern-not-working/199685/7 "2019-10-14T20:06:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.