# Logstash grok OSSEC

**URL:** <https://discuss.elastic.co/t/logstash-grok-ossec/120188>\
**Category:** Logstash\
**Created:** [February 16, 2018, 1:54pm UTC](https://discuss.elastic.co/t/logstash-grok-ossec/120188 "2018-02-16T13:54:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [February 16, 2018, 1:54pm UTC](https://discuss.elastic.co/t/logstash-grok-ossec/120188/1 "2018-02-16T13:54:19Z")

</div>

Hello

A few days ago I was trying to make a grok to get the values ​​of a specific field. For example, within my text lines I want to extract the data from 'Source Network Address'

Process Information: Process ID: 0x0 Process Name: - Network Information: Workstation Name: DSW2K12EXC Source Network Address: 10.240.67.111 Source Port: 23065

I tried to do it with this, but it has not worked. Can you give me some idea or correct me?

grok

{  
patterns\_dir =\> "/etc/logstash/patterns/"  
match =\> { "message" =\> "\s\*%{IP:Source Network Adrress}" }  
}

Greetings

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [February 17, 2018, 7:18am UTC](https://discuss.elastic.co/t/logstash-grok-ossec/120188/2 "2018-02-17T07:18:13Z")

</div>

Using your example message...

```auto
grok {
  match => {
    "message" => "Process Information: Process ID: (?<process_id>0x[0-9A-F]+) Process Name: %{GREEDYDATA:process_name} Network Information: Workstation Name: %{HOSTNAME:workstation_name} Source Network Address: %{IP:source_network_name} Source Port: %{NONNEGINT:source_port}"
  }
}

```

Testing this with Grok Debugger the results are...

```auto
{
  "source_network_name": "10.240.67.111",
  "process_id": "0x0",
  "process_name": "-",
  "source_port": "23065",
  "workstation_name": "DSW2K12EXC"
}

```

---

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [March 9, 2018, 5:24pm UTC](https://discuss.elastic.co/t/logstash-grok-ossec/120188/3 "2018-03-09T17:24:17Z")

</div>

Thanks @rcowart

Can you help me with whis?

New Logon: Security ID: S-1-5-21-887713730-3897031439-636582496-1618 Account Name: UG009494$

I did try with this, but didn't work.

grok {  
match =\> ["message","New Logon: Security ID: {GREEDYDATA:security\_id} Account Name: %{USERNAME:account\_name}"]  
}

Greetings

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2018, 5:24pm UTC](https://discuss.elastic.co/t/logstash-grok-ossec/120188/4 "2018-04-06T17:24:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.