# Using Grok filter
**URL:** https://discuss.elastic.co/t/using-grok-filter/321051
**Category:** Logstash
**Created:** [December 12, 2022, 3:31pm UTC](https://discuss.elastic.co/t/using-grok-filter/321051 "2022-12-12T15:31:40Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Groove](https://discuss.elastic.co/u/Groove)
#### Post date: [December 12, 2022, 3:31pm UTC](https://discuss.elastic.co/t/using-grok-filter/321051/1 "2022-12-12T15:31:40Z")
Hello, I am pretty new to ELK stack. Currently I am trying to parse my application log using grok pattern. But since my logs are not structured I may have to use grok conditions, because in output I have windows event and deepsecurity logs.
I am trying the below, but It doesn't work:
```auto
filter {
if [message] =~ "\bDeep Security\b" {
mutate {
gsub => ["message", "\t", "|"]
add_tag => ["Deep Security"]
}
grok {
match => { "message" => "%{SYSLOG5424PRI}%{SYSLOGTIMESTAMP:devTime}" }
}
date {
match => ["devTime", "MMM dd HH:mm:ss", "MMM dd HH:mm:ss"]
}
kv {
source => "message"
value_split => "="
field_split => "|"
}
```
Desired result : deepsecurity logs be the same format as windows event logs
\<135\>1 2022-12-12T16:28:02Z HOSTNAME EvntSLog - - - Le service Service de licences de client (ClipSVC) est entré dans l’état : arrêté.
230 \<134\>Dec 12 16:28:02 HOSTNAME CEF:0|Trend Micro|Deep Security Manager|20.0.703|602|User Timed Out|
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 9, 2023, 3:32pm UTC](https://discuss.elastic.co/t/using-grok-filter/321051/2 "2023-01-09T15:32:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.