Logstash Filters - Grok a email advice

Hi, I was trying to grok a email log message to take the email address and make a field of it. I google it and i don't find the patterns to do it. Any help please??

Message examples:

**** ALERT **** Failed IMAP authentication attempt from for "test1@test.com" [EvSecurity]

**** ALERT **** Failed SMTP authentication attempt from for "test2@test.com" [EvSecurity]


Didn't test it, but you should be able to use this as a starting point:

    grok {
    match => [
         "message", "^%{DATA:alertmessage} from %{IP:ipaddress} for \"%{NOTSPACE:email_address}\" \[EvSecurity\]$"
1 Like

Thank you very much, it works perfect!

grok patterns are not anchored by default, so you could just use

grok { match => [ "message", "%{EMAILADDRESS:email_address}" ] }

to grab the email address.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.