Not able to create separate fields all log data in message field

Elastic Stack Logstash
1

I am new to Grock filter tried with grok debugger working fine in it
but not able to create new fields all log data are in the message field
this is my configuration file.
#Windows Firewall
input {
beats {
port => 5044
}
}

filter {
if [fileset][module] == "iis" {
grok {
break_on_match => false

match log structure using grok

match => { "message" => "%{GREEDYDATA:Date} %{GREEDYDATA:Time} %{WORD:action} %{WORD:protocol} %{IP:source_ip} %{IP:destination_ip} %{INT:SrcPort} %{INT:DstPort} %{INT:Size} %{GREEDYDATA:Size}" }
}
}
}

output {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

   }

   stdout { codec => rubydebug }
   }
2

this is my log
2019-06-29 12:49:40 ALLOW UDP 192.168.1.1 x.x.x.x 59445 53 0 - - - - - - - SEND

3

x.x.x.x is not a valid IP address, so it does not match. If you replace that with, for example, 192.168.2.2 then, provided that your event contains a [fileset][module] field with the right value, it matches and you will get

          "Date" => "2019-06-29",
"destination_ip" => "192.168.2.2",
     "source_ip" => "192.168.1.1",
          "Time" => "12:49:40",
          "Size" => [
    [0] "0",
    [1] "- - - - - - - SEND"
],
       "message" => "2019-06-29 12:49:40 ALLOW UDP 192.168.1.1 192.168.2.2 59445 53 0 - - - - - - - SEND",
       "DstPort" => "53",
        "action" => "ALLOW",
       "SrcPort" => "59445",
      "protocol" => "UDP"
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.