# Parsing a syslog log **URL:** \ **Category:** Logstash\ **Created:** [March 18, 2021, 12:01pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651 "2021-03-18T12:01:44Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [March 18, 2021, 12:01pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/1 "2021-03-18T12:01:44Z")
Im receiving the following log (some things changes for privacy, althought the password is literally sent as asterisks) \<134\> 2021/03/18:13:33:41 SYSTEMNAME 0-PPE-0 : default GUI CMD\_EXECUTED 1324333 0 : User invaliduser - Remote\_ip 192.168.23.1 - Command "login invaliduser "**"" - Status "ERROR: Invalid username or password" \<134\> 2021/03/18:13:33:49 SYSTEMNAME 0-PPE-0 : default GUI CMD\_EXECUTED 1324393 0 : User validuser - Remote\_ip 192.168.23.1 - Command "login validuser "**"" - Status "Success" I So I need to parse this as the following ID = \<134\> Timestamp = 2021/03/18:13:33:41 Hostname = SYSTEMNAME Interface = 0-PPE-0 Section = default Via= GUI Action = CMD\_EXECUTED CommandCode = 1324333 CommandCodeTwo = 0 User = invaliduser RemoteIP = 192.168.23.1 Command = login invaliduser "\*\*\*\*\*\*\*\*" Status = ERROR: Invalid username or password How can I do this? What should I use? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 18, 2021, 5:30pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/2 "2021-03-18T17:30:16Z")
I would suggest using dissect. If you cannot dissect it then use grok. ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [March 22, 2021, 2:42pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/3 "2021-03-22T14:42:20Z")
I actually attempted to use dissect but it didnt work out: ``` dissect { mapping => { "message" => "%{id} %{ts} %{hostname} %{interface} : %{typeofaction} %{code} 0 : User %{user} - Remote_ip %{remoteip} - Command "login %{user} " ********"" - Status %{description}" } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 22, 2021, 4:37pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/4 "2021-03-22T16:37:59Z")
You appear to have two spaces after %{ts}, but not in the actual message. Also ": %{typeofaction} %{code} 0 :" does not match ": default GUI CMD\_EXECUTED 1324393 0 :". Perhaps ": %{typeofaction} %{code} %{+code} 0 :" so that [code] picks out both GUI and CMD\_EXECUTED. Also, the login field pattern looks wrong. In dissect, a pattern like "%{foo} %{bar}" matches anything that is not a space, followed by a single space, followed by anything that is not a space. When space is a delimiter neither foo nor bar can contain a space. ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [March 22, 2021, 5:01pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/5 "2021-03-22T17:01:04Z")
Thank you. Let me take another look at it and see if maybe that is what is wrong. I went ahead and took a shot with grok as well: ``` filter { grok { match => ["message" => "<%{BASE10NUM:ID}> %{YEAR:Year}/%{MONTHNUM:Month}/%{MONTHDAY:Day}:%{HOUR:Hour}:%{MINUTE:Minute}:%{SECOND:Second} %{HOSTNAME:Hostname} %{DATA:Interface} : %{DATA:Type} %{DATA:CliOrGuiType} %{DATA:Action} %{INT:EventID} %{INT:ExitCode} : User %{USERNAME:User} - Remote_ip %{IP:Remote_IP} - Command "%{DATA:Command} """ - Status "%{DATA:Message}""] } } ``` It gives a error on that grok line when trying to load the conf ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 22, 2021, 5:20pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/6 "2021-03-22T17:20:04Z")
That should be ``` grok { match => { "message" => '<%{BASE10NUM:ID}> ... "%{DATA:Message}"' } } ``` rather than ``` grok { match => ["message" => "<%{BASE10NUM:ID}> ... "%{DATA:Message}""] } ``` ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [March 22, 2021, 6:10pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/7 "2021-03-22T18:10:32Z")
I attempted with the "{" and the "[" as well...... I do notice that you use ' instead of " ; Does that make a difference? I am escaping with `\"` Maybe there lies my issue? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 22, 2021, 6:21pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/8 "2021-03-22T18:21:46Z")
The match option of grok expects a hash. Generally, logstash is will to convert ``` match => ["fieldName", "pattern"] ``` to ``` match => { "fieldName" => "pattern" } ``` and vice versa when an option expects an array. However, ``` match => ["fieldName" => "pattern"] ``` is neither fish nor fowl and logstash will object to it. If pattern contains double quotes you can either surround it with single quotes or escape the double quotes using backslash. What error is logstash logging? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 19, 2021, 6:22pm UTC](https://discuss.elastic.co/t/parsing-a-syslog-log/267651/9 "2021-04-19T18:22:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.