# Substitute GROK by dissect: test of writing

**URL:** https://discuss.elastic.co/t/substitute-grok-by-dissect-test-of-writing/342930
**Category:** Logstash
**Created:** [September 13, 2023, 10:05am UTC](https://discuss.elastic.co/t/substitute-grok-by-dissect-test-of-writing/342930 "2023-09-13T10:05:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sam1975](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 13, 2023, 10:05am UTC](https://discuss.elastic.co/t/substitute-grok-by-dissect-test-of-writing/342930/1 "2023-09-13T10:05:34Z")

</div>

hello,  
I want to substitute a grok filter by a dissect  
In a few words, i want replace this grok filter

grok {  
match =\> { "[raw\_syslog\_result][syslog\_message]" =\> [  
"THREAT,%{WORD:threat\_type},%{DATA:generate\_time},%{IP:source\_ip},%{IP:dest\_ip},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA},%{DATA:threat\_contentname},%{DATA:threat\_category},%{GREEDYDATA}"  
]}  
}

by this one

dissect{  
mapping =\> {  
"THREAT" =\> "{%threat\_type} {%generate\_time} {%source\_ip}{%dest\_ip}{%threat\_contentname}{%threat\_category}"  
}  
}

i've doubt on the syntax: is that correct?  
Regards

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [September 13, 2023, 10:27am UTC](https://discuss.elastic.co/t/substitute-grok-by-dissect-test-of-writing/342930/2 "2023-09-13T10:27:38Z")

</div>

Should be like this:

```auto
 dissect {
	mapping => {
        "[raw_syslog_result][syslog_message]" => "THREAT,%{threat_type},%{generate_time} %{source_ip},%{dest_ip},%{},%{},(put %{}enough times),%{threat_contentname},%{threat_category},%{}"
	}

```

Also you can use CSV plugin for that. Something like this:

```auto
  csv{
     source => "[raw_syslog_result][syslog_message]"
     columns => ["THREAT","threat_type", "generate_time"...] # add other column names
     skip_empty_columns => true
     skip_empty_rows => true
	}

```

---

<div class="post-metadata">

### Author: ![sam1975](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 13, 2023, 12:07pm UTC](https://discuss.elastic.co/t/substitute-grok-by-dissect-test-of-writing/342930/3 "2023-09-13T12:07:54Z")

</div>

nice! it works

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 11, 2023, 12:08pm UTC](https://discuss.elastic.co/t/substitute-grok-by-dissect-test-of-writing/342930/4 "2023-10-11T12:08:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.