# Same Grok Filter for two somehow similar logs

**URL:** <https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242>\
**Category:** Logstash\
**Created:** [April 9, 2020, 5:48am UTC](https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242 "2020-04-09T05:48:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ismail\_Zam\_Zam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismail_zam_zam/32/56696_2.png) [@Ismail\_Zam\_Zam](https://discuss.elastic.co/u/Ismail_Zam_Zam)\
**Post date:** [April 9, 2020, 5:48am UTC](https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242/1 "2020-04-09T05:48:18Z")

</div>

`type=EXECVE msg=audit(1585994474.430:1397): argc=5 a0="script" a1="-q" a2="-c" a3=6563686F2044415441 a4="file_to_write"`

`type=EXECVE msg=audit(1585994474.430:1397): argc=2 a0="apt-get" a1="install"`

I want to parse these logs by single grok filter. The First log have 5 arguments and the second log has 2 arguments. One way is doing it by using two grok filters but if there is a good method other then that, please guide me. I also use the Logical 'OR' after the second argument in the filter but the filter only parse the log till the end of second argument and ignore the other.

`type=%{WORD:[type]} msg=audit\(%{NUMBER}:%{NUMBER:[sequence]}\): (%{GREEDYDATA})?a0=\"%{DATA:[a0]}\"( %{GREEDYDATA})? (%{GREEDYDATA})?a1=\"%{DATA:[a1]}\"( %{GREEDYDATA})? (%{GREEDYDATA})?a2=\"%{DATA:[a2]}\"( %{GREEDYDATA})?`

Kindly answer it as soon as possible. Thanks in advance!

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [April 9, 2020, 10:21am UTC](https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242/2 "2020-04-09T10:21:32Z")

</div>

I recommend a different approach.

If you take a look, your messages have a _ **header** _ portion - `type=EXECVE msg=audit(1585994474.430:1397)` - and a _ **payload** _ portion - `argc=5 a0="script" a1="-q" a2="-c" a3=6563686F2044415441 a4="file_to_write"`.

You can use a `grok` filter to parse the _header_, putting the _payload_ in a temporary `@metadata` field.

```auto
type=%{WORD:[type]} msg=audit\(%{NUMBER}:%{NUMBER:[sequence]}\): %{GREEDYDATA:[@metadata][payload]}

```

Then use a simple `kv` filter to convert the key-value pairs in `[@metadata][payload]` into fields. Something like...

```auto
kv {
  source => "[@metadata][payload]"
  trim_value => "\""
}

```

Rob

[![GitHub](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f8ae834f16b1a02d31607317669716807844d84.png)](https://github.com/robcowart) [![YouTube](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43b9b81a8c93786219985aeb5335c1c323449053.png)](https://www.youtube.com/channel/UCivWvTx1DwrWNcDLV58kmOg) [![LinkedIn](https://us1.discourse-cdn.com/elastic/original/3X/6/7/674f3370d0f0542ddc5e408516beb1b7edd6c1bf.png)](https://www.linkedin.com/in/robertcowart/)  
**[How to install Elasticsearch & Kibana on Ubuntu - incl. hardware recommendations](https://www.youtube.com/watch?v=gZb7HpVOges)**  
**[What is the best storage technology for Elasticsearch?](https://www.youtube.com/watch?v=nKUpfJCBiS4)**

---

<div class="post-metadata">

**Author:** ![Ismail\_Zam\_Zam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismail_zam_zam/32/56696_2.png) [@Ismail\_Zam\_Zam](https://discuss.elastic.co/u/Ismail_Zam_Zam)\
**Post date:** [April 9, 2020, 10:51am UTC](https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242/3 "2020-04-09T10:51:15Z")

</div>

Thank You @rcowart buddy. I have done using Logical Operator "OR", previously i was not using OR operator in a right way that satisfy my requirement.  
`type=%{WORD:[type]} msg=audit\(%{NUMBER}:%{NUMBER:[auditd][log][sequence]}\): (%{GREEDYDATA})?(a0=\"%{DATA:[a0]}\" a1=\"%{DATA:[a1]}\" a2=\"%{DATA:[a2]}\" a3=\"%{DATA:[a3]}\" a4=\"%{DATA:[a4]}\"|a0=\"%{DATA:[a0]}\" a1=\"%{DATA:[a1]}\")`

Once again @rcowart thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2020, 11:02am UTC](https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242/4 "2020-05-07T11:02:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.