# Netscaler grok pattern

**URL:** <https://discuss.elastic.co/t/netscaler-grok-pattern/84254>\
**Category:** Logstash\
**Created:** [May 2, 2017, 11:55am UTC](https://discuss.elastic.co/t/netscaler-grok-pattern/84254 "2017-05-02T11:55:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [May 2, 2017, 11:55am UTC](https://discuss.elastic.co/t/netscaler-grok-pattern/84254/1 "2017-05-02T11:55:30Z")

</div>

Hi

i've googled the following grok pattern for this as follows

if [type] == "Netscaler" {  
grok {

match =\> [  
"message", "\<%{POSINT:syslog\_pri}\> \<ns\_syslog\_timestamp\>%{DATE}:%{TIME} %{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:netscaler\_message} : %{DATA} %{IP:source\_ip}:%{POSINT:source\_port} - %{DATA} %{IP:vserver\_ip}:%{POSINT:vserver\_port} - %{DATA} %{IP:nat\_ip}:%{POSINT:nat\_port} - %{DATA} %{IP:destination\_ip}:%{POSINT:destination\_port} - %{DATA} %{DATE\_US:DELINK\_DATE}:%{TIME:DELINK\_TIME} GMT - %{DATA} %{POSINT:total\_bytes\_sent} - %{DATA} %{POSINT:total\_bytes\_recv}",  
"message", "\<%{POSINT:syslog\_pri}\> \<ns\_syslog\_timestamp\>%{DATE}:%{TIME} %{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:netscaler\_message} : %{DATA} %{IP:source\_ip}:%{POSINT:source\_port} - %{DATA} %{IP:destination\_ip}:%{POSINT:destination\_port} - %{DATA} %{DATE\_US:START\_DATE}:%{TIME:START\_TIME} GMT - %{DATA} %{DATE\_US:END\_DATE}:%{TIME:END\_TIME} GMT - %{DATA} %{POSINT:total\_bytes\_sent} - %{DATA} %{POSINT:total\_bytes\_recv}",  
"message", "\<%{POSINT:syslog\_pri}\> \<ns\_syslog\_timestamp\>%{DATE}:%{TIME} %{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:netscaler\_message} : %{DATA} %{INT:netscaler\_spcbid} - %{DATA} %{IP:clientip} - %{DATA} %{INT:netscaler\_client\_port} - %{DATA} %{IP:netscaler\_vserver\_ip} - %{DATA} %{INT:netscaler\_vserver\_port} %{GREEDYDATA:netscaler\_message} - %{DATA} %{WORD:netscaler\_session\_type}",  
"message", "\<%{POSINT:syslog\_pri}\> \<ns\_syslog\_timestamp\>%{DATE}:%{TIME} %{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:netscaler\_message}"  
]  
}

but it ends up as, best i can tell, not being parsed:

@timestamp May 2nd 2017, 13:44:29.823  
t @version 1  
t \_id AVvI-dyf7s6S-ye7T3AQ  
t \_index netscaler-2017.05.02

# \_score -

t \_type Netscaler  
t host 172.17.20.190  
t message \<134\> 05/02/2017:11:44:29 GMT dc2-ns1-vpx1 0-PPE-0 : default TCP CONN\_DELINK 588243517 0 : Source 172.17.200.144:63435 - Vserver XXX.XX.214.171:80 - NatIP XXX.XX.214.170:32206 - Destination XXX.XX.214.164:80 - Delink Time 05/02/2017:11:44:29 GMT - Total\_bytes\_send 12112 - Total\_bytes\_recv 6717  
t tags \_grokparsefailure  
t type Netscaler

what am i missing here or is there a better/simpler way to handle netscaler syslog logfiles?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2017, 12:07pm UTC](https://discuss.elastic.co/t/netscaler-grok-pattern/84254/2 "2017-05-30T12:07:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.