# Should I need raw data to create a Grok Filter? **URL:** \ **Category:** Logstash\ **Created:** [November 21, 2022, 3:58am UTC](https://discuss.elastic.co/t/should-i-need-raw-data-to-create-a-grok-filter/319386 "2022-11-21T03:58:36Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![aaron.chang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron.chang/32/113558_2.png) [@aaron.chang](https://discuss.elastic.co/u/aaron.chang)\ **Post date:** [November 21, 2022, 3:58am UTC](https://discuss.elastic.co/t/should-i-need-raw-data-to-create-a-grok-filter/319386/1 "2022-11-21T03:58:36Z")
Hi , I am a new user to use ELK. I want to analyze Aruba Controller & MM's syslog. But ELK don't have Aruba's template to show clearly. So I need to grok it by myself. From some article ,I know that ELK will not save the raw data Should I output raw data of Aruba's syslog to try to grok it ? Or did I have another way to make the default "type:syslog" more clearly? Thanks ---
**Author:** ![aaron.chang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron.chang/32/113558_2.png) [@aaron.chang](https://discuss.elastic.co/u/aaron.chang)\ **Post date:** [November 22, 2022, 8:33am UTC](https://discuss.elastic.co/t/should-i-need-raw-data-to-create-a-grok-filter/319386/2 "2022-11-22T08:33:08Z")
I can't understand. If I can't read raw logs . How could I grok it? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 20, 2022, 8:33am UTC](https://discuss.elastic.co/t/should-i-need-raw-data-to-create-a-grok-filter/319386/3 "2022-12-20T08:33:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.