I make grok filter with this condition but noting show anything on grok debugger. Log format is Modsecurity audit log (?%{YEAR}[./]%{MONTHNUM}[./]%{MONTHDAY} %{TIME}) [%{LOGLEVEL:severity}] %{POSINT:pid}#%{NUMBER:threadid}: *%{NUMBER:connectionid} %{GREEDYDATA:attack}, client: %{IP:client}, server:…

Modsecurity Log Grok Filter

warkolm (Mark Walkom) November 20, 2020, 3:42am 2

Showing an example of that would be helpful to match it with your grok.

Topic		Replies	Views
Parse Modsecurity json logs Logstash	6	2130	September 16, 2019
Apply Grok to a log file Logstash	4	285	June 22, 2021
Grok works in debugger but not in Logstash Logstash	4	351	June 7, 2021
Grok filter log Logstash	8	517	July 4, 2018
Combined grok pattern for customized logs Logstash	21	1609	September 5, 2023

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Modsecurity Log Grok Filter

Related topics