# \[SOLVED\] Grok or not Grok on SophosXG

**URL:** <https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896>\
**Category:** Logstash\
**Created:** [August 24, 2018, 11:05am UTC](https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896 "2018-08-24T11:05:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tardis](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@tardis](https://discuss.elastic.co/u/tardis)\
**Post date:** [August 24, 2018, 11:05am UTC](https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896/1 "2018-08-24T11:05:14Z")

</div>

Hi,  
apologies but I'm struggling to find a good reference document with examples, and I'm basing this on test and fail from a pattern test tool.  
I'm trying to parse a **SophosXG** log message, as this one below:  
_device="SFW" log\_type="Firewall" src\_ip=111.222.333.444_

there's many fields defined on the same structure _TAG=VALUE_  
is there a way to get all tags and associated values?  
Right now I'm having to use _(device=%{QS:device\_01})_ entries for each value, which is slow and painful.

Any help or direction to the right documentation would be appreciated.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 24, 2018, 11:12am UTC](https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896/2 "2018-08-24T11:12:58Z")

</div>

Look at using the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) instead of grok for this type of data.

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [August 24, 2018, 11:15am UTC](https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896/3 "2018-08-24T11:15:52Z")

</div>

Grok Patterns

[https://grokdebug.herokuapp.com/patterns#](https://grokdebug.herokuapp.com/patterns#)

> <https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns>

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [August 24, 2018, 11:17am UTC](https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896/4 "2018-08-24T11:17:29Z")

</div>

For online grok parsing

[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

---

<div class="post-metadata">

**Author:** ![tardis](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@tardis](https://discuss.elastic.co/u/tardis)\
**Post date:** [August 26, 2018, 8:02am UTC](https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896/5 "2018-08-26T08:02:35Z")

</div>

Kv filter using whitespace worked like charm. Thank you.

if [type] == "sophosxg" {  
kv {  
whitespace =\> strict  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2018, 8:02am UTC](https://discuss.elastic.co/t/solved-grok-or-not-grok-on-sophosxg/145896/6 "2018-09-23T08:02:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.