# Need Help with Grok of Cisco VPN Logs

**URL:** <https://discuss.elastic.co/t/need-help-with-grok-of-cisco-vpn-logs/185016>\
**Category:** Kibana\
**Created:** [June 10, 2019, 3:53pm UTC](https://discuss.elastic.co/t/need-help-with-grok-of-cisco-vpn-logs/185016 "2019-06-10T15:53:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [June 10, 2019, 3:53pm UTC](https://discuss.elastic.co/t/need-help-with-grok-of-cisco-vpn-logs/185016/1 "2019-06-10T15:53:07Z")

</div>

Trying to parse a Cisco vpn log and running into an issue with parsing the event id. Below is the raw log and I'd like to parse out the 722051. I'm able to parse everything after that but not that one. I have the grok pattern as ASA-svc-4-%{NUMBER:event\_id} and tried other value types but no luck. Any suggestions?

```
<164>:Jun 04 18:49:02 EDT: %ASA-svc-4-722051: Group <VPN_USER> User <user.name> IP <66.13.256.38> IPv4 Address <192.168.200.3> IPv6 address <::> assigned to session
```

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [June 11, 2019, 1:08pm UTC](https://discuss.elastic.co/t/need-help-with-grok-of-cisco-vpn-logs/185016/2 "2019-06-11T13:08:11Z")

</div>

I was able to figure out the correct type of NOTSPACE so this now works: ASA-svc-4-%{NOTSPACE:source}:

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2019, 1:08pm UTC](https://discuss.elastic.co/t/need-help-with-grok-of-cisco-vpn-logs/185016/3 "2019-07-09T13:08:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.