# Logstash JSON GROK Parsing

**URL:** <https://discuss.elastic.co/t/logstash-json-grok-parsing/161162>\
**Category:** Logstash\
**Created:** [December 17, 2018, 1:53pm UTC](https://discuss.elastic.co/t/logstash-json-grok-parsing/161162 "2018-12-17T13:53:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kenny\_H](https://avatars.discourse-cdn.com/v4/letter/k/35a633/32.png) [@Kenny\_H](https://discuss.elastic.co/u/Kenny_H)\
**Post date:** [December 17, 2018, 1:53pm UTC](https://discuss.elastic.co/t/logstash-json-grok-parsing/161162/1 "2018-12-17T13:53:10Z")

</div>

I am new to Logstash and Grok with Non Developer background. Can anyone help me with GROK parsing for below.

{  
"source": "logs",  
"id": "9ab3ce4e-fff7-11e8-be78-06da4fe50a90",  
"recorded": "2018-14-12T23:25:55.228Z",  
"actors": [  
{  
"type": "user",  
"name": "abc123456"  
}  
],  
"resources": ,  
"result": {  
"status": "POLICY",  
"message": "Authentication Details:\nIP Address: 208.66.218.169\nCountry: US\nNew Device: false\nRequested Application ID: d4c6830e-af0b-48a6-b846-d28ffc54d4a3\nRequested Application Name: N/A\nPassword Reset: false\nSelf Service Device Management: false\nTime since last Authentication: In the last 17 minutes\nTime since last Authentication from Office: N/A\nMobile OS Version: iOS 12.1\nDevice Model: iPhone X\nDevice Lock Enabled: true\nDevice Rooted or Jailbroken: false\nDevice enrolled in MDM: false\nPingID App Version: 1.8.5\nAction: Fingerprint (with fallback)\nPolicy Met: Default Policy\nRule Met: "Default Action"\n"  
}  
}

AND

{  
"source": "TOKEN",  
"id": "9bc4efce-fff7-11e8-be9e-02743401c720",  
"recorded": "2018-14-12T23:25:57.018Z",  
"action": {  
"type": "SSO\_IDP"  
},  
"actors": [  
{  
"type": "user",  
"name": "ABC12345"  
},  
{  
"type": "user.service",  
"name": "ABC12345"  
}  
],  
"resources": [  
{  
"id": "571f1bbc-52f8-4ca7-b80b-1e30240e7feb",  
"type": "IDP",  
"name": "SK",  
"idpEntityId": "SK"  
},  
{  
"id": "076a52e5-9d71-4e92-8580-b4908051c6d3",  
"type": "SP",  
"name": "customer1"  
},  
{  
"id": "79685301-1e21-4f20-97c5-72a9ae5b92be",  
"type": "CONNECTION",  
"name": "customer"  
}  
],  
"client": {  
"id": "Mozilla/5.0\_(Macintosh;\_Intel\_Mac\_OS\_X\_10\_14\_2)_AppleWebKit/537.36_(KHTML,\_like\_Gecko)\_Chrome/71.0.3578.98\_Safari/537.36",  
"ipAddress": "208.66.218.169"  
},  
"result": {  
"status": "SUCCESS",  
"message": "success"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2019, 2:00pm UTC](https://discuss.elastic.co/t/logstash-json-grok-parsing/161162/2 "2019-01-14T14:00:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.