Problem With parsing mikrotik log

Elastic Stack Logstash
#1

Hi
i've been trying to normalize mikrotik log with grok in logstash and my sample log is :

Feb 20 04:38:02 192.168.202.101 id=firewall sn=C0EAE45CA55 time="2021-02-20 12:54:43" fw=188.126.145.3 pri=6 c=1 m=911 msg="Added host entry to dynamic address object" n=6776584 note="FQDN=*.microsoft.com; TTL=56; Host=20.49.150.241" fw_action="NA"

and this is what i did up to now :

%{SYSLOGTIMESTAMP:syslog_timestamp} %{IPV4:sensor_ip} %{DATA:id}=%{WORD:device_name} %{DATA:sn}=%{USERNAME:device_id} time="%{TIMESTAMP_ISO8601:device_time}"

this parsing all fields except this part time="%{TIMESTAMP_ISO8601:device_time}" and my logstash faced with problem and failed i would be thankful if someone help me to normalize this log.

#2

Use this grok to parse the message

%{SYSLOGTIMESTAMP:syslog_timestamp} %{IPV4:sensor_ip} %{GREEDYDATA:kv_message}

combined with a KV filter to get dynamically all fields, refer to this issue on github also to get an idea

   kv {
       source => "kv_message"
       "field_split" : """\s(?![-_.,:()\w ]+?(\s+|$))""",
       "value_split" : """(?<!\\)=""",
   }
1 Like
#3

thanks Bro,
i fixed my problem and i'd like to share this link with others for normalizing mikrotik logs.