# Unable to parse data with grok

**URL:** <https://discuss.elastic.co/t/unable-to-parse-data-with-grok/374362>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [February 11, 2025, 12:38pm UTC](https://discuss.elastic.co/t/unable-to-parse-data-with-grok/374362 "2025-02-11T12:38:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eshwar\_K](https://avatars.discourse-cdn.com/v4/letter/e/82dd89/32.png) [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)\
**Post date:** [February 11, 2025, 12:38pm UTC](https://discuss.elastic.co/t/unable-to-parse-data-with-grok/374362/1 "2025-02-11T12:38:47Z")

</div>

Hi Team,

I have following logs and trying to parse with grok pattern but not able to get proper grok pattern for it. Kindly help me to to parse data into JSON format.

I am trying to write the pattern as below.

2025-01-19 23:56:49,Major,WIN-T0RGB9G66A7,Event Description: The client will block traffic from IP address 192.168.10.62 for the next 600 seconds (from 1/19/2025 11:56:45 PM to 1/20/2025 12:06:45 AM). ,Event Type: Active Response,Local Host IP: 192.168.10.52,Local Host MAC: 000C29F0E882,Remote Host Name: ,Remote Host IP: 192.168.10.62,Remote Host MAC: 000C292124E3,Inbound,OTHERS,,Begin: 2025-01-19 23:56:45,End Time: 2025-01-20 00:06:45,Occurrences: 1,Application: ,Location: Default,User Name: Administrator,Domain Name: WIN-T0RGB9G66A7,Local Port: 0,Remote Port: 0,CIDS Signature ID: 0,CIDS Signature string: ,CIDS Signature SubID: 0,Intrusion URL: ,Intrusion Payload URL: ,SHA-256: ,MD-5: ,Intensive Protection Level: N/A,URL Risk: N/A,URL Category: N/A,Correlation ID:

Thank you in advance.

Regards,  
Eshwar

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 11, 2025, 12:55pm UTC](https://discuss.elastic.co/t/unable-to-parse-data-with-grok/374362/2 "2025-02-11T12:55:29Z")

</div>

I wouldn't use grok for that. You could start with

```
    dissect { mapping => { "message" => "%{[@metadata][timestamp]},%{field1},%{[host][name]},%{[@metadata][restOfLine]}" } }
    date { match => ["[@metadata][timestamp]", "YYYY-MM-dd HH:mm:ss" ] }
    kv { source => "[@metadata][restOfLine]" field_split => "," value_split => ":" }

```