# Messages are not al same, how to grok?

**URL:** <https://discuss.elastic.co/t/messages-are-not-al-same-how-to-grok/273993>\
**Category:** Logstash\
**Created:** [May 25, 2021, 10:14pm UTC](https://discuss.elastic.co/t/messages-are-not-al-same-how-to-grok/273993 "2021-05-25T22:14:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![edvrfn](https://avatars.discourse-cdn.com/v4/letter/e/4bbf92/32.png) [@edvrfn](https://discuss.elastic.co/u/edvrfn)\
**Post date:** [May 25, 2021, 10:14pm UTC](https://discuss.elastic.co/t/messages-are-not-al-same-how-to-grok/273993/1 "2021-05-25T22:14:53Z")

</div>

Logs sent by my gateway are not exactly same, how to handle missing fields in the logs with grok.

Below Works

`TDM,50c9676c6d24,udm-1.9.3.3438 kernel: [1393127.673482] IN=br20 ***OUT=eth4*** MAC=74:ac:b9:1e:f3:00:e8:b1:fc:83:eb:68:08:00 SRC=192.168.2.80 DST=148.251.12.230 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=6672 DF PROTO=TCP SPT=4638 DPT=443 WINDOW=513 RES=0x00 ACK URGP=0 MARK=0x4`

Working Grok

`%{IPORHOST:hostname},%{SYSLOGHOST},udm-%{BACULA_VERSION} kernel: \[%{MAVEN_VERSION}] IN=%{BACULA_DEVICE:incoming_int} OUT=%{BACULA_DEVICE:outgoing_int} MAC=%{MAC}:%{MAC}%{NOTSPACE} SRC=%{IPORHOST:ip.source} DST=%{IPORHOST:ip.destination} LEN=%{NUMBER:length} TOS=%{BASE16NUM:TOS} PREC=%{BASE16NUM:PREC} TTL=%{NUMBER:TTL} ID=%{NUMBER:ID} DF PROTO=%{WORD:Protocol} SPT=%{NUMBER:port.source} DPT=%{NUMBER:port.destination} WINDOW=%{NUMBER:window_size} RES=%{BASE16NUM} %{GREEDYDATA:flags}`

non working logs with same grok above

TDM,50c9676c6d24,udm-1.9.3.3438 kernel: [1394432.790629] IN=br0 _ **OUT=** _ MAC=76:ac:b9:1e:f2:fc:74:ac:b9:a8:83:73:08:00 SRC=192.168.0.66 DST=192.168.2.1 LEN=576 TOS=0x00 PREC=0x00 TTL=255 ID=43112 PROTO=TCP SPT=49958 DPT=8080 WINDOW=2144 RES=0x00 _ **ACK PSH URGP=0** _

In the log above there is no value after OUT= and TCP flags in the end are different. How to make GROK compatible,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 25, 2021, 10:26pm UTC](https://discuss.elastic.co/t/messages-are-not-al-same-how-to-grok/273993/2 "2021-05-25T22:26:47Z")

</div>

Instead of using grok I would suggest using dissect and kv. There is an example [here](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786/2).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2021, 10:27pm UTC](https://discuss.elastic.co/t/messages-are-not-al-same-how-to-grok/273993/3 "2021-06-22T22:27:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.