Parsing issue in Logstash grok

Elastic Stack Logstash
1

I am having a grok issue. I have a log like below

Login Success [user: jsaver] [Source: 10.110.20.58]

How can I parse the this log with grok filter ?

2

Here is an example to show how it works.

Sample Data - Login Success [user: jsaver] [Source: 10.110.20.58]

Pattern - %{DATA:action} %{DATA:outcome} \[user: %{USERNAME:user}\] \[Source: %{IPV4:source}\]

Result

{
  "action": "Login",
  "source": "10.110.20.58",
  "user": "jsaver",
  "outcome": "Success"
}
1 Like
3

Thanks for the replay.

Is it possible to parse action and outcome together?

like "action": "Login Success"

4

Pattern
(?<action>%{WORD} %{WORD}) \[user: %{USERNAME:user}\] \[Source: %{IPV4:source}\]

Result

{
  "action": "Login Success",
  "source": "10.110.20.58",
  "user": "jsaver"
}
1 Like
5

thanks

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.