# Need to create filter for logstash **URL:** \ **Category:** Logstash\ **Created:** [March 8, 2018, 10:19am UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042 "2018-03-08T10:19:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mlala](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@mlala](https://discuss.elastic.co/u/mlala)\ **Post date:** [March 8, 2018, 10:19am UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042/1 "2018-03-08T10:19:38Z")
Hi, I am trying to prepare filter for F5 ASM but using GROK Debugger i am facing issue related to same can anyone help with with proper logstash filter. i will paste the log file for your convenience. \<134\>Mar 8 12:40:06 DC-INT-SLB-02.zms.local ASM:"192.168.48.118","N/A","N/A","192.168.35.166","443","2018-03-08 12:40:06","Information Leakage","/Common/www.xxx.lm.sa.app/www.xxx.lm.sa\_vs","192.168.48.118%0","","192.168.90.14","POST","2016-04-10 10:03:56","/Common/www.xxx.lm.sa.app/www.xxx.lm.sa\_vs","HTTPS","","POST /sites/Home/wservices/JsonWebService.asmx/ReadHighLightsXml HTTP/1.1\r\nAccept: /\r\nContent-Type: application/json; charset=utf-8\r\nReferer: [https://www.xxx.lm.sa/sites/Home/\r\nAccept-Language:](https://www.xxx.lm.sa/sites/Home/%5Cr%5CnAccept-Language:) ar-BR\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko\r\nHost: www.xxx.lm.sa\r\nContent-Length: 16\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nCookie: \_ga=GA1.3.1270259754.1482313131; ASP.NET\_SessionId=idwovi550sj00445isqmdi2f; lang=ar-BR; BIGipServerPool\_dp\_2014\_80=2606606528.20480.0000; TS0145a324=0184b023f4e6a1b6cd88dd0017c4c93b24b52ad5fb24e435fe7e31a47f621ab3e7d8cd0108e60d4b4d276a1b3466c52b8143af3edf200722b6836db714f49e967fdf9dbcdaa8315187828a971fd19905 BR ML ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 8, 2018, 7:25pm UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042/2 "2018-03-08T19:25:37Z")
It's basically a standard syslog message (see example in the Logstash documentation) where the message part can be processed by a csv filter. ---
**Author:** ![mlala](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@mlala](https://discuss.elastic.co/u/mlala)\ **Post date:** [March 11, 2018, 8:22am UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042/3 "2018-03-11T08:22:36Z")
> [@magnusbaeck](#): > > where the message part can be processed by a csv filter Hi Magnusbaeck, actually i already have found a similar article related to my issue but i am still not able to achieve my required output. unfortunately that ticket has been closed. you can search for "Logstash grok customized filter f5 big-ip" Regards ML ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 11, 2018, 7:59pm UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042/4 "2018-03-11T19:59:59Z")
> actually i already have found a similar article related to my issue but i am still not able to achieve my required output. What does your configuration look like? What output do you get? > unfortunately that ticket has been closed. you can search for "Logstash grok customized filter f5 big-ip" I don't see how that would be helpful. ---
**Author:** ![mlala](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@mlala](https://discuss.elastic.co/u/mlala)\ **Post date:** [March 12, 2018, 7:58am UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042/5 "2018-03-12T07:58:26Z")
What does your configuration look like? What output do you get? Configuration: input { udp { port =\> 514 type =\> syslog } tcp { port =\> 514 type =\> syslog } } filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } output { elasticsearch { hosts =\> "localhost:9200" index =\> "f5-%{+YYYY.MM.dd}" manage\_template =\> false } } Output is: ![output](https://us1.discourse-cdn.com/elastic/original/3X/4/6/46891c36e99a8da183e64b2a812fa12f75b54fd6.JPG) BR ML ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 12, 2018, 8:06am UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042/6 "2018-03-12T08:06:26Z")
`%{DATA:syslog_program}` matches too much, and looking at the syslog message at least these messages don't have a program and pid at all. Try this instead: ``` ^%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} ASM: %{GREEDYDATA:syslog_message} ``` Then use a csv filter to parse `syslog_message`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 9, 2018, 8:06am UTC](https://discuss.elastic.co/t/need-to-create-filter-for-logstash/123042/7 "2018-04-09T08:06:35Z")
Closed on April 9, 2018, 8:06am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.