Problem With parsing mikrotik log

i've been trying to normalize mikrotik log with grok in logstash and my sample log is :

Feb 20 04:38:02 id=firewall sn=C0EAE45CA55 time="2021-02-20 12:54:43" fw= pri=6 c=1 m=911 msg="Added host entry to dynamic address object" n=6776584 note="FQDN=*; TTL=56; Host=" fw_action="NA"

and this is what i did up to now :

%{SYSLOGTIMESTAMP:syslog_timestamp} %{IPV4:sensor_ip} %{DATA:id}=%{WORD:device_name} %{DATA:sn}=%{USERNAME:device_id} time="%{TIMESTAMP_ISO8601:device_time}"

this parsing all fields except this part time="%{TIMESTAMP_ISO8601:device_time}" and my logstash faced with problem and failed i would be thankful if someone help me to normalize this log.

Use this grok to parse the message

%{SYSLOGTIMESTAMP:syslog_timestamp} %{IPV4:sensor_ip} %{GREEDYDATA:kv_message}

combined with a KV filter to get dynamically all fields, refer to this issue on github also to get an idea

   kv {
       source => "kv_message"
       "field_split" : """\s(?![-_.,:()\w ]+?(\s+|$))""",
       "value_split" : """(?<!\\)=""",
1 Like

thanks Bro,
i fixed my problem and i'd like to share this link with others for normalizing mikrotik logs.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.