# Logstash Snort Log Parse Error

**URL:** <https://discuss.elastic.co/t/logstash-snort-log-parse-error/149309>\
**Category:** Logstash\
**Created:** [September 20, 2018, 2:04pm UTC](https://discuss.elastic.co/t/logstash-snort-log-parse-error/149309 "2018-09-20T14:04:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [September 20, 2018, 2:04pm UTC](https://discuss.elastic.co/t/logstash-snort-log-parse-error/149309/1 "2018-09-20T14:04:53Z")

</div>

hi,

i want to parse my snort log file with grok but pattern couldnt parse it.

Here is my log file example;

{ "timestamp" : "09/20-07:12:23.851184", "msg" : "Nmap XMAS Tree Scan", "priority" : 0, "proto" : "TCP", "src\_addr" : "192.168.2.242", "src\_port" : 50004, "dst\_addr" : "192.168.2.250", "dst\_port" : 22 }

I tried everything but didnt!

I want to parse message and add fields like msg, src\_addr, src\_port etc.

I edited log file:

**TCP 192.168.2.242 50004 192.168.2.250 22**

and wrote filter:

> filter {  
> if [type] == "snort" {  
> grok {  
> match =\> { "message" =\> "%{IP:src\_ip} %{NUMBER:src\_port} %{IP:dst\_ip} % {NUMBER:dst\_port}"}  
> }  
> mutate {  
> convert =\> { "src\_port" =\> "integer" }  
> convert =\> { "dst\_port" =\> "integer" }  
> add\_field =\> {  
> "src\_ip" =\> "%{src\_ip}"  
> "src\_port" =\> "%{src\_port}"  
> "dst\_ip" =\> "%{dst\_ip}"  
> "dst\_port" =\> "%{dst\_port}"  
> }  
> }  
> }  
> }

it didnt work.

Anybody can help me for write filter ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 20, 2018, 2:27pm UTC](https://discuss.elastic.co/t/logstash-snort-log-parse-error/149309/2 "2018-09-20T14:27:06Z")

</div>

That looks like JSON. Have you tried using a json filter?

---

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [September 28, 2018, 11:15am UTC](https://discuss.elastic.co/t/logstash-snort-log-parse-error/149309/3 "2018-09-28T11:15:43Z")

</div>

We used json parser but it didnt work because of our logstash source was wrong. After fix it we solved this issue. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2018, 11:15am UTC](https://discuss.elastic.co/t/logstash-snort-log-parse-error/149309/4 "2018-10-26T11:15:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.