# Problem With parsing mikrotik log

**URL:** <https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977>\
**Category:** Logstash\
**Created:** [February 21, 2021, 8:58am UTC](https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977 "2021-02-21T08:58:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![asan](https://avatars.discourse-cdn.com/v4/letter/a/db5fbb/32.png) [@asan](https://discuss.elastic.co/u/asan)\
**Post date:** [February 21, 2021, 8:58am UTC](https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977/1 "2021-02-21T08:58:46Z")

</div>

Hi  
i've been trying to normalize mikrotik log with grok in logstash and my sample log is :

Feb 20 04:38:02 192.168.202.101 id=firewall sn=C0EAE45CA55 time="2021-02-20 12:54:43" fw=188.126.145.3 pri=6 c=1 m=911 msg="Added host entry to dynamic address object" n=6776584 note="FQDN=\*.microsoft.com; TTL=56; Host=20.49.150.241" fw\_action="NA"

and this is what i did up to now :

%{SYSLOGTIMESTAMP:syslog\_timestamp} %{IPV4:sensor\_ip} %{DATA:id}=%{WORD:device\_name} %{DATA:sn}=%{USERNAME:device\_id} time="%{TIMESTAMP\_ISO8601:device\_time}"

this parsing all fields except this part time="%{TIMESTAMP\_ISO8601:device\_time}" and my logstash faced with problem and failed i would be thankful if someone help me to normalize this log.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [February 21, 2021, 10:17am UTC](https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977/2 "2021-02-21T10:17:51Z")

</div>

Use this grok to parse the message

```auto
%{SYSLOGTIMESTAMP:syslog_timestamp} %{IPV4:sensor_ip} %{GREEDYDATA:kv_message}

```

combined with a KV filter to get dynamically all fields, refer to this [issue](https://github.com/elastic/elasticsearch/issues/31786) on github also to get an idea

```auto
   kv {
       source => "kv_message"
       "field_split" : """\s(?![-_.,:()\w]+?(\s+|$))""",
       "value_split" : """(?<!\\)=""",
   }

```

---

<div class="post-metadata">

**Author:** ![asan](https://avatars.discourse-cdn.com/v4/letter/a/db5fbb/32.png) [@asan](https://discuss.elastic.co/u/asan)\
**Post date:** [February 23, 2021, 5:17am UTC](https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977/3 "2021-02-23T05:17:08Z")

</div>

thanks Bro,  
i fixed my problem and i'd like to share this link with others for normalizing mikrotik logs.

> <https://github.com/frap/logstash/blob/master/patterns/mikrotik>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2021, 5:17am UTC](https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977/4 "2021-03-23T05:17:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.