# Need help with grok parsing

**URL:** <https://discuss.elastic.co/t/need-help-with-grok-parsing/100437>\
**Category:** Logstash\
**Created:** [September 14, 2017, 1:34am UTC](https://discuss.elastic.co/t/need-help-with-grok-parsing/100437 "2017-09-14T01:34:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Benoit\_Martin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benoit_martin/32/21235_2.png) [@Benoit\_Martin](https://discuss.elastic.co/u/Benoit_Martin)\
**Post date:** [September 14, 2017, 1:34am UTC](https://discuss.elastic.co/t/need-help-with-grok-parsing/100437/1 "2017-09-14T01:34:59Z")

</div>

Hi,

I try to use grok and parse two type of log entry possibility.

The field is a hostname receive by Cisco Prime.

Possibility 1 : `AP23132_01,80:e0:1d:e0:c2:10`  
Possibility 2 : `80:e0:1d:e0:c2:10:AP23132_01`

AP23132\_01 can also vary with that pattern name.

AP23174\_02  
TCDAYFA001  
TCDMYFA005  
TCDQYFA004  
TEDFYFA003  
TMDGYFA002  
TEHBYFA001  
TMDFYFA006  
TTELYFA111

I build a regex with regex101 and the result is `^[A-Z|0-9]{7}.\d{2}`

Now I use grok and try to extract mac address from that filed and add a field MACADDRESS and extract the APNAME with the regex.

```auto
    grok {
      match => { "thefield" => ["%{MAC:MACADDRESS}", "(?<APNAME>^[A-Z|0-9]{7}.\d{2})" ] }
    }

```

Mac address part work fine but the APNAME part is not working. Can you help me to find the right solution .

Thank you!!!

---

<div class="post-metadata">

**Author:** ![Benoit\_Martin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benoit_martin/32/21235_2.png) [@Benoit\_Martin](https://discuss.elastic.co/u/Benoit_Martin)\
**Post date:** [September 14, 2017, 2:52pm UTC](https://discuss.elastic.co/t/need-help-with-grok-parsing/100437/2 "2017-09-14T14:52:23Z")

</div>

I fix my problem by using 2 grok instead of one. Someone can help me to use a better way to do that please ?

```auto
    grok {
      match => { "CISCO-PRIME::Nom_Equipement" => "%{MAC:MACADDRESS}" }
    }
    grok {
      match => { "CISCO-PRIME::Nom_Equipement" => "(?<APNAME>(^|)[A-Z|0-9]{7}.\d{2})" }
    }

```

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [September 14, 2017, 3:27pm UTC](https://discuss.elastic.co/t/need-help-with-grok-parsing/100437/3 "2017-09-14T15:27:43Z")

</div>

You will have to use 2 groks.  
That is the only way of doing it, that I am aware of.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2017, 3:27pm UTC](https://discuss.elastic.co/t/need-help-with-grok-parsing/100437/4 "2017-10-12T15:27:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.