# Logstash/Grok not processing part of a custom filter

**URL:** <https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559>\
**Category:** Logstash\
**Created:** [November 18, 2016, 4:13pm UTC](https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559 "2016-11-18T16:13:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![brian.jones](https://avatars.discourse-cdn.com/v4/letter/b/22d042/32.png) [@brian.jones](https://discuss.elastic.co/u/brian.jones)\
**Post date:** [November 18, 2016, 4:13pm UTC](https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559/1 "2016-11-18T16:13:33Z")

</div>

Not sure if I am missing something, or just going about this all wrong, but some of the syslog events from our ASA just don't seem to filter/parse correctly.

Relevant syslog events:

> ```
> "message":"<150>Nov 18 2016 15:50:23: %ASA-6-113004: AAA user authentication Successful : server = 1.2.3.4 : user = some.username\n"
> "message":"<150>Nov 18 2016 15:50:23: %ASA-6-113004: AAA user authorization Successful : server = 1.2.3.4 : user = some.username\n"
> "message":"<150>Nov 18 2016 15:50:23: %ASA-6-113008: AAA transaction status ACCEPT : user = some.username\n"
> 
> ```

Current grok filter lines related to syslog events above:

> ```
> "message", "%{WORD:protocol} user authentication %{WORD:action} : server = %{IP:auth_srv} : user = %{DATA:user}\n",
> "message", "%{WORD:protocol} user authorization %{WORD:action} : server = %{IP:auth_srv} : user = %{DATA:user}\n",
> "message", "%{WORD:protocol} transaction status %{WORD:action} : user = {%DATA:user}\n",
> 
> ```

I am not sure if the " : " in each event is what might be causing the issue, but that seems to be the only common thing between the events that won't process. I have dozens of other custom filters before and after these lines that work just fine.

---

<div class="post-metadata">

**Author:** ![brian.jones](https://avatars.discourse-cdn.com/v4/letter/b/22d042/32.png) [@brian.jones](https://discuss.elastic.co/u/brian.jones)\
**Post date:** [November 22, 2016, 8:31pm UTC](https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559/2 "2016-11-22T20:31:25Z")

</div>

Anybody have any ideas?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 27, 2016, 8:01pm UTC](https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559/3 "2016-11-27T20:01:32Z")

</div>

One thing I notice immediately is that there are two spaces before the IP address in your example entries but your expression requires a single space.

In general, debug problems like this by starting with the simplest possible expression. Then add a little bit more so that you step by step converge towards the current expression that doesn't work. At some point things are going to start failing and then you've narrowed it down sufficiently to be able to spot the culprit.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2016, 8:01pm UTC](https://discuss.elastic.co/t/logstash-grok-not-processing-part-of-a-custom-filter/66559/4 "2016-12-25T20:01:32Z")

</div>

Closed on December 25, 2016, 8:01pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.