# Mcafee DAM syslog parsing Logstash

**URL:** <https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136>\
**Category:** Logstash\
**Created:** [January 29, 2017, 5:00pm UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136 "2017-01-29T17:00:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![HawkUser](https://avatars.discourse-cdn.com/v4/letter/h/ecccb3/32.png) [@HawkUser](https://discuss.elastic.co/u/HawkUser)\
**Post date:** [January 29, 2017, 5:00pm UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136/1 "2017-01-29T17:00:59Z")

</div>

Hi Community,

i'm looking for logstash idea how to parse the next content:  
`<15>#externalId=0#rt=1XXXX1#cs1=SaXXM XX-XXXXXX#cs1Label=XXX#dst=XX.XX.xx.xx#src=xx.xx.xx.xxx#duser=xxx_xxxx#suser=#shost=XXX-XXXXXXX#dproc=xxxxx#act=SELECT#cs2=SELECT XXXX,XXX,XXXX,XXXX,XXXXX FROM xxxxx.dbo.xxxxx WHERE xxxxx \\= @X1 AND (xxxxx is null) ORDER BY xxxxx ASC ,xxxxx ASC ,xxxxx ASC#cs3=#cs3Label=AccessedObjects#cs2Label=SqlStatement\u0000`

i hashed the real values but the columns are real, also the delimiter is by request i customize the sender to delim using "#",  
i tried the following config:

```
input {
  tcp {
    port => 5002
    type => syslog
    tags => ["dam"]
  }
  udp {
    port => 5002
    type => syslog
    tags => ["dam"]
  }
}

filter {
  if "dam" in [tags] {
    ruby {
        code => "
            fieldArray = event.get('message').split('#')
            for field in fieldArray
                field = field.delete('#')
                result = field.split('=',1)
                temp_key = 'key_' + result[0]
                temp_value = 'value_' + result[1]
                event.set(temp_key, temp_value)
            end

        "
    }
  }
}

```

i tried lot of trick even using KV, i believe i'm doing something wrong ☹

`[2017-01-29T00:04:10,785][ERROR][logstash.filters.ruby] Ruby exception occurred: can't convert nil into String`

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 29, 2017, 5:10pm UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136/2 "2017-01-29T17:10:42Z")

</div>

You should be able to use a [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) to capture the start of the message before the key-value string and store the rest into a variable. You can then use the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) with custom field separator ('#') to parse the key-value list in this variable before using a [mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) to it.

---

<div class="post-metadata">

**Author:** ![HawkUser](https://avatars.discourse-cdn.com/v4/letter/h/ecccb3/32.png) [@HawkUser](https://discuss.elastic.co/u/HawkUser)\
**Post date:** [January 29, 2017, 5:30pm UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136/3 "2017-01-29T17:30:18Z")

</div>

Hi,

Thank you for the reply, believe it or not I tried pretty much everything 😉  
Is there any chance there is sample?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 1, 2017, 4:38am UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136/4 "2017-02-01T04:38:56Z")

</div>

Show us what you have right now and it'll be easier for us to point you in the right direction.

---

<div class="post-metadata">

**Author:** ![HawkUser](https://avatars.discourse-cdn.com/v4/letter/h/ecccb3/32.png) [@HawkUser](https://discuss.elastic.co/u/HawkUser)\
**Post date:** [February 1, 2017, 8:45am UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136/5 "2017-02-01T08:45:43Z")

</div>

Hi,  
i mention it above, the configuration and the data sample  
thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 1, 2017, 8:59am UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136/6 "2017-02-01T08:59:15Z")

</div>

I thought you had actually tried using grok and kv as Christian mentioned. You're looking for something like this:

```nohighlight
filter {
  grok {
    match => ["message", "^<%{INT}>#%{GREEDYDATA:kv}"]
  }
  kv {
    source => "kv"
    field_split => "#"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2017, 8:59am UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136/7 "2017-03-01T08:59:18Z")

</div>

Closed on March 1, 2017, 8:59am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.