# Need help in parsing log in grok

**URL:** <https://discuss.elastic.co/t/need-help-in-parsing-log-in-grok/158843>\
**Category:** Logstash\
**Created:** [November 30, 2018, 2:48am UTC](https://discuss.elastic.co/t/need-help-in-parsing-log-in-grok/158843 "2018-11-30T02:48:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![luongthenghi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luongthenghi/32/75190_2.png) [@luongthenghi](https://discuss.elastic.co/u/luongthenghi)\
**Post date:** [November 30, 2018, 2:48am UTC](https://discuss.elastic.co/t/need-help-in-parsing-log-in-grok/158843/1 "2018-11-30T02:48:44Z")

</div>

Hi support team  
I have raw logs below:  
GlobalProtect gateway user authentication succeeded. Login from: 14.15.10.62, Source region: VN, Login from: 14.187.170.62, User name: dungh, Auth type: profile, Client OS version: Android 7.0.  
GlobalProtect gateway client configuration generated. User name: dungh, Private IP: 172.16.253.251, Client version: 4.1.6-2, Device name: SM-G950F-ce031713cd4518710d, Client OS version: Android 7.0, VPN type: Device Level VPN.

And grok code:  
%{GREEDYDATA:message\_vpn}. ((Login from: )%{IP:IP\_from})?(,\s)?((Source·region: )(?\<Source\_region\>[a-zA-Z]+))?(,\s)?%{GREEDYDATA:tail}

My issue is ouput log incorrect and it isn't get "Source region". Help me!

I attacked image of output grok.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4eabba960543fec4021e11f43d997b3a0d71e829.png)

Thanks,

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [November 30, 2018, 4:23am UTC](https://discuss.elastic.co/t/need-help-in-parsing-log-in-grok/158843/2 "2018-11-30T04:23:24Z")

</div>

Hi,

Have you tried using the Grok debugger app included in Kibana (Dev Tools) to troubleshoot this? I used the included app and found that your Grok was not parsing in the correct format.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d55487ffa945cf008e4e4cf554659e05b8cc213f.png)

Also, if your logs are coming in the mentioned format, I would suggest you use something like KV to parse the data. Would you try using a config similar to this?

```auto
grok {
  match => { "message" => "%{GREEDYDATA:message_vpn}\. %{GREEDYDATA:remainder}" }
}
kv {
  target => "remainder"
  field_split => ","
  value_split => ":"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2018, 4:23am UTC](https://discuss.elastic.co/t/need-help-in-parsing-log-in-grok/158843/3 "2018-12-28T04:23:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.