Logstash Grok isnt working

Elastic Stack Logstash
1

I am trying to parse this but it isnt working

Raw Logs

	
<187>SCO-N9504-CS01: 2025 Mar 31 18:34:03 UTC: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed from console - login (message repeated 1 time)

Code

filter {
grok{
match => {"message" => "<%{INT:syslog_priority}>%{WORD:hostname}-%{WORD:device_id}: %{TIMESTAMP_ISO8601:timestamp} %{WORD:timezone}: %%{DATA:syslog_message_type}-%{INT:severity}-%{WORD:log_message}: %{DATA:application}: %{GREEDYDATA:message}"
}
}
}

I get A GrokParseFailure

2

That doesn't surprise me. Your log message has three words between the priority and the colon, but your pattern only matches two. Also, that timestamp is not ISO8601, and there is no space between the application and message fields.

Try

    grok {
        pattern_definitions => { "TIMESTAMP" => "%{YEAR} %{SYSLOGTIMESTAMP} %{WORD:timezone}" }
        match => { "message" => "<%{INT:syslog_priority}>%{WORD:hostname}-%{WORD:device_id}-%{WORD}: %{TIMESTAMP:timestamp}: %%{DATA:syslog_message_type}-%{INT:severity}-%{WORD:log_message}: %{DATA:application}:%{GREEDYDATA:message}" }
        overwrite => [ "message" ]
    }
3

Thanks! that did the trick! , silly mistakes , but i am getting duplicate fields now, why do i have a text / keyword field

Screenshot 2025-03-31 162104
Screenshot 2025-03-31 162104436×394 22.2 KB

4

See this post. It's not a logstash issue.

1 Like