# Parse linux cron log

**URL:** <https://discuss.elastic.co/t/parse-linux-cron-log/181620>\
**Category:** Logstash\
**Created:** [May 17, 2019, 3:05pm UTC](https://discuss.elastic.co/t/parse-linux-cron-log/181620 "2019-05-17T15:05:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Semir](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@Semir](https://discuss.elastic.co/u/Semir)\
**Post date:** [May 17, 2019, 3:05pm UTC](https://discuss.elastic.co/t/parse-linux-cron-log/181620/1 "2019-05-17T15:05:57Z")

</div>

Hello,  
I'm a newbie in ELK. i'm trying to parse cron log. i'm using grokdebugger to test my grok pattern.

my input is like this :  
May 12 06:01:01 bela-vtu182 run-parts(/etc/cron.hourly)[28118]: starting 0anacron  
May 12 06:01:01 bela-vtu182 run-parts(/etc/cron.hourly)[28127]: finished 0anacron  
May 12 06:01:01 bela-vtu182 run-parts(/etc/cron.hourly)[28118]: starting fusioninventory-agent  
May 12 06:01:01 bela-vtu182 run-parts(/etc/cron.hourly)[28134]: finished fusioninventory-agent  
May 12 07:01:01 bela-vtu182 CROND[28338]: (root) CMD (run-parts /etc/cron.hourly)

my grok pattern is like this  
%{MONTH:Month} %{MONTHDAY:Jour} %{TIME:Temps} %{HOSTNAME:Serveur} %{GREEDYDATA:autre}[%{NUMBER:ID}]: (%{USER:user})%{GREEDYDATA:commande}

my grok pattern function for lines who contain (root).

{  
"Temps": "07:01:01",  
"Serveur": "bela-vtu182",  
"Month": "May",  
"Jour": "12",  
"ID": "28338",  
"commande": " CMD (run-parts /etc/cron.hourly)",  
"user": "root",  
"autre": "CROND"  
}

but it does not function for the others input lines.  
I would like to add a condition, to remove the field "user" when it is not present.

Can someone help me?  
Thank you by advance.

---

<div class="post-metadata">

**Author:** ![Oozza](https://avatars.discourse-cdn.com/v4/letter/o/76d3ee/32.png) [@Oozza](https://discuss.elastic.co/u/Oozza)\
**Post date:** [May 17, 2019, 3:21pm UTC](https://discuss.elastic.co/t/parse-linux-cron-log/181620/2 "2019-05-17T15:21:10Z")

</div>

Hi,  
I am using this expression `(?:\[%{DATA:thread}\])` to match string in square brackets if it's present.  
So I believe something like `(?:\(%{USER:user}\))` should work for you.  
Slashes are there as an escape character, while (?: ...) is probably the construction you were looking for

---

<div class="post-metadata">

**Author:** ![Semir](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@Semir](https://discuss.elastic.co/u/Semir)\
**Post date:** [May 20, 2019, 10:23am UTC](https://discuss.elastic.co/t/parse-linux-cron-log/181620/3 "2019-05-20T10:23:34Z")

</div>

Hello Oozza,

Thank you very much, it helps me a lot.  
finally i used the next pattern which seems to function  
(?:(%{USER:user})|(%{GREEDYDATA:commande}))  
The pipe used to indicate that we expect to have user or command line.

I close the discuss and declare it resolved.  
Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2019, 10:23am UTC](https://discuss.elastic.co/t/parse-linux-cron-log/181620/4 "2019-06-17T10:23:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.