# Parsing Alcatel PBX multiline log tickets

**URL:** <https://discuss.elastic.co/t/parsing-alcatel-pbx-multiline-log-tickets/1586>\
**Category:** Logstash\
**Created:** [May 30, 2015, 9:51am UTC](https://discuss.elastic.co/t/parsing-alcatel-pbx-multiline-log-tickets/1586 "2015-05-30T09:51:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![almaza](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@almaza](https://discuss.elastic.co/u/almaza)\
**Post date:** [May 30, 2015, 9:51am UTC](https://discuss.elastic.co/t/parsing-alcatel-pbx-multiline-log-tickets/1586/1 "2015-05-30T09:51:39Z")

</div>

Hi,

I am trying to parse call trace logs from an Alcatel PBX and could not find any examples on it being done.

I found how to pick up the complete tickets using multiline.  
The messages vary, all messages have a header field and most but not all an additional data field.  
The header and data fields are not identical in the different tickets.

Three example tickets:  
Message 1:

* * *

| (045925:000002) Concatenated-Physical-Event :  
| long: 56 desti: 0 source: 0 cryst: 1 cpl: 2 us: 0 term: 0 type a5  
| tei: 0 \>\>\>\> message received : SETUP [05] Call ref : 31 6f  
| SENDING COMPLETE  
|\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_  
|  
| IE:[04] BEARER\_CAPABILITY (l=3) 90 90 a3  
| IE:[18] CHANNEL (l=3) a9 83 81 -\> T2 : B channel 1 exclusive  
| IE:[1e] PROGRESS\_ID (l=2) 81 83  
| IE:[6c] CALLING\_NUMBER (l=9) -\> 80 Num : 12345678  
| IE:[70] CALLED\_NUMBER (l=10) -\> 80 Num : 087654321  
|\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Message 2:

* * *

| (045932:000013) Concatenated-Physical-Event :  
| long: 18 desti: 0 source: 0 cryst: 8 cpl: 2 us: 0 term: 0 type a5  
| tei: 0 \>\>\>\> message received : CONNECT ACK (0f) Call ref : 00 02  
|\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Message 3:

* * *

| (045948:000014) 1228: Send\_IO1 (link-nbr=1, sapi=0, tei=0) :  
| long: 55 desti: 0 source: 15 cryst: 7 cpl: 2 us: 8 term: 0 type a5  
| tei: 0 \<\<\<\< message sent : SETUP [05] Call ref : 00 0b  
|\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_  
|  
| IE:[04] BEARER\_CAPABILITY (l=3) 90 90 a3  
| IE:[1e] PROGRESS\_ID (l=2) 80 83  
| IE:[6c] CALLING\_NUMBER (l=10) -\> 21 81 Num : 12345678  
| IE:[70] CALLED\_NUMBER (l=9) -\> 81 Num : 87654321  
| IE:[7d] HLC (l=2) 91 81  
| [a1] Sending complete  
|\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

I have tried with various stuff but the closest I've ever been is this filter which give me an array containing the ticket in lines.

filter  
{

# Alcatel PBX Tickets

if [type] == "debug"  
{  
multiline  
{  
pattern =\> "^|"  
what =\> "previous"  
}  
mutate  
{  
split =\> { "message" =\> "|" }  
}  
}  
}

In bash I would probably have made an array for the header and one for the data and parsed them from there but how do I do this in logstash?

I tried many grok methods but they all crashed because the tickets are different in syntax.  
Are there any other filters I should use instead?

Any constructive feedback is welcomed 🙂

---

<div class="post-metadata">

**Author:** ![almaza](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@almaza](https://discuss.elastic.co/u/almaza)\
**Post date:** [July 30, 2015, 8:57am UTC](https://discuss.elastic.co/t/parsing-alcatel-pbx-multiline-log-tickets/1586/2 "2015-07-30T08:57:09Z")

</div>

Just in case anyone else have the same issue as I had this is the config I ended up with.  
Not very elegant I know, but it seem to do the trick.

input  
{  
tcp  
{  
port =\> 11111  
type =\> "alcatel-ticket"  
}  
}  
filter  
{  
multiline  
{  
pattern =\> "^|"  
what =\> "previous"  
}  
}  
filter  
{  
if [type] == "alcatel-ticket" and "multiline" in [tags] and "+--------+-------+--------+" not in [message]  
{  
grok  
{  
match =\> ["message", "(?m)%{NUMBER:alch\_event\_uptime}:%{NUMBER:alch\_event\_no}%{NEXT\_PIPE}%{NEXT\_COLON}:%{NEXT\_COLON}:%{NEXT\_COLON}:%{NEXT\_COLON}: \*%{BASE16NUM:alch\_cryst}%{NEXT\_COLON}: \*%{BASE16NUM:alch\_cpl}%{NEXT\_ARROW\_NOT}%{NOTSPACE:alch\_event\_direction}%{NEXT\_COLON}: \*%{NEXT\_ALT8\_NOT:alch\_event\_name}%{NEXT\_COLON}: \*%{BASE16NUM} _%{BASE16NUM:alch\_callref2}%{NEXT\_UNDER}\__%{GREEDYDATA:alc\_body}"]  
remove\_tag =\> ["multiline"]  
}  
if [alc\_body]  
{  
if "CALLING\_NUMBER" in [alc\_body]  
{  
grok  
{  
match =\> ["alc\_body", "(?m)%{NEXT\_CALLING}%{NEXT\_COLON}: \*%{NUMBER:alcb\_number\_calling}"]  
}  
if "\_grokparsefailure" in [tags]  
{  
mutate  
{  
add\_field =\> { "alcb\_number\_calling" =\> "" }  
remove\_tag =\> ["\_grokparsefailure"]  
}  
}  
}  
if "CALLED\_NUMBER" in [alc\_body]  
{  
grok  
{  
match =\> ["alc\_body", "(?m)%{NEXT\_CALLED}%{NEXT\_COLON}: \*%{NUMBER:alcb\_number\_called}"]  
}  
if "\_grokparsefailure" in [tags]  
{  
mutate  
{  
add\_field =\> { "alcb\_number\_called" =\> "" }  
remove\_tag =\> ["\_grokparsefailure"]  
}  
}  
}  
if "CONNECTED\_NUMBER" in [alc\_body]  
{  
grok  
{  
match =\> ["alc\_body", "(?m)%{NEXT\_CONNECTED}%{NEXT\_COLON}: \*%{NUMBER:alcb\_number\_connected}"]  
}  
if "\_grokparsefailure" in [tags]  
{  
mutate  
{  
add\_field =\> { "alcb\_number\_connected" =\> "" }  
remove\_tag =\> ["\_grokparsefailure"]  
}  
}  
}  
else if "DATE" in [alc\_body]  
{  
grok  
{  
match =\> ["alc\_body", "(?m)%{NEXT\_ARROW\_NOT}\>%{NEXT\_COLON}: \*%{NUMBER:alcb\_event\_date\_dd} \*/ \*%{NUMBER:alcb\_event\_date\_mm} \*/ \*%{NUMBER:alcb\_event\_date\_yy} \*%{NUMBER:alcb\_event\_date\_HH}:%{NUMBER:alcb\_event\_date\_MM}"]  
add\_field =\> { "alcb\_event\_date" =\> "20%{alcb\_event\_date\_yy}%{alcb\_event\_date\_mm}%{alcb\_event\_date\_dd}-%{alcb\_event\_date\_HH}%{alcb\_event\_date\_MM}" }  
remove\_field =\> ["alc\_body", "alcb\_event\_date\_yy", "alcb\_event\_date\_mm", "alcb\_event\_date\_dd", "alcb\_event\_date\_HH", "alcb\_event\_date\_MM"]  
}  
}  
else if "DISCONNECT" in [alch\_event\_name]  
{  
grok  
{  
match =\> ["alc\_body", "(?m)%{NEXT\_ARROW\_NOT}\> \*%{NEXT\_PIPE:alcb\_disconnect\_reason}"]  
remove\_field =\> ["alc\_body"]  
}  
mutate  
{  
gsub =\> ["alcb\_disconnect\_reason", "[\n]", ""]  
}  
}  
}

```
# Cleanup
if [alch_event_direction]
{
  if ">>>" in [alch_event_direction]
  {
    mutate
    {
      replace => { "alch_event_direction" => "received" }
    }
  }
  else if "<<<" in [alch_event_direction]
  {
    mutate
    {
      replace => { "alch_event_direction" => "sent" }
    }
  }
}
if [alch_event_name]
{
  mutate
  {
    strip => ["alch_event_name"]
  }
}
mutate
{
  convert => {"alch_event_uptime" => "integer"}
  convert => {"alch_event_no" => "integer"}
}

```

}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/parsing-alcatel-pbx-multiline-log-tickets/1586/3 "2017-07-06T05:33:23Z")

</div>

Closed on July 6, 2017, 5:33am UTC