# Nexsus log grok parse **URL:** \ **Category:** Logstash\ **Created:** [December 17, 2018, 2:54am UTC](https://discuss.elastic.co/t/nexsus-log-grok-parse/161065 "2018-12-17T02:54:14Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![dh77hd](https://avatars.discourse-cdn.com/v4/letter/d/5daacb/32.png) [@dh77hd](https://discuss.elastic.co/u/dh77hd)\ **Post date:** [December 17, 2018, 2:54am UTC](https://discuss.elastic.co/t/nexsus-log-grok-parse/161065/1 "2018-12-17T02:54:14Z")
Hi. I wanna parse Nexsus log using grok filter. But, it doesn't work. please help me. **Here is my log** \<189\>: 2018 Dec 17 11:33:04 KST: %ETHPORT-5-IF\_ADMIN\_UP: Interface Ethernet1/40 is admin up . **and I want to parse like this.** \<189\>: =\> remove 2018 Dec 17 11:33:04 KST: =\> receive time %ETHPORT-5-IF\_ADMIN\_UP: =\> facility - loglevel - mnemonic Interface Ethernet1/40 is admin up . =\> message **Here is my grok filter** grok { patterns\_dir =\> ["/etc/logstash/conf.d/patterns"] match =\> { "message" =\> "\<%{INT:sequence}\>:%{NEXUSTIMESTAMP:syslog\_timestamp}: %%{DATA:facility}-%{INT:log-level}-%{DATA:facility\_mnemonic}:%{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] add\_tag =\> ["success"] } **patterns file**. CISCOTIMESTAMPTZ %{CISCOTIMESTAMP}( %{TZ})? NEXUSTIMESTAMP %{YEAR} %{MONTH} %{MONTHDAY} %{TIME}( %{TZ})? ---
**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\ **Post date:** [December 17, 2018, 6:23am UTC](https://discuss.elastic.co/t/nexsus-log-grok-parse/161065/2 "2018-12-17T06:23:36Z")
@dh77hd You have probably error at the end of timezone (CISCOTIMESTAMPTZ). The following grok works, you just need to build a pattern file out of it. `%{INT:sequence}>\:%{SPACE}%{YEAR}%{SPACE}%{MONTH}%{SPACE}%{MONTHDAY}%{SPACE}%{TIME}%{SPACE}%{WORD:tz}\:%{SPACE}%{NOTSPACE:facility}\-%{NOTSPACE:loglevel}\-%{NOTSPACE:facility_mnemonic}%{SPACE}%{GREEDYDATA:msg}` ---
**Author:** ![dh77hd](https://avatars.discourse-cdn.com/v4/letter/d/5daacb/32.png) [@dh77hd](https://discuss.elastic.co/u/dh77hd)\ **Post date:** [December 17, 2018, 7:57am UTC](https://discuss.elastic.co/t/nexsus-log-grok-parse/161065/3 "2018-12-17T07:57:25Z")
Thank you so much 🙂 It's works! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 14, 2019, 7:57am UTC](https://discuss.elastic.co/t/nexsus-log-grok-parse/161065/4 "2019-01-14T07:57:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.