# GROK Formatting

**URL:** <https://community.graylog.org/t/grok-formatting/8862>\
**Category:** Graylog Central (peer support)\
**Created:** [February 14, 2019, 2:41pm UTC](https://community.graylog.org/t/grok-formatting/8862 "2019-02-14T14:41:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![fnk](https://avatars.discourse-cdn.com/v4/letter/f/ac8455/32.png) [@fnk](https://community.graylog.org/u/fnk)\
**Post date:** [February 14, 2019, 2:41pm UTC](https://community.graylog.org/t/grok-formatting/8862/1 "2019-02-14T14:41:49Z")

</div>

I have a basic authentication log formatted as follows:

2018-03-19 15:11:46,181 https-jsse-nio-443-exec-246 JiraServiceAccount 911x8252778x1 - 192.168.0.1 /rest/api/2/search The user ‘ServiceAccount’ has PASSED authentication.  
2018-03-19 15:11:46,744 https-jsse-nio-443-exec-251 JiraServiceAccount 911x8252779x1 - 192.168.0.1 /rest/api/2/search The user ‘ServiceAccount’ has PASSED authentication.

I’m finding it easy enough to pull out the date but I just can’t figure out how to pull/ignore the https-jsse-nio-443 after it?

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [February 14, 2019, 3:04pm UTC](https://community.graylog.org/t/grok-formatting/8862/2 "2019-02-14T15:04:09Z")

</div>

a. don’t log it in your app  
b. cut extractor  
c. pipeline

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 14, 2019, 3:16pm UTC](https://community.graylog.org/t/grok-formatting/8862/3 "2019-02-14T15:16:10Z")

</div>

Read the Docs: [http://docs.graylog.org/en/2.5/pages/extractors.html#using-grok-patterns-to-extract-data](http://docs.graylog.org/en/2.5/pages/extractors.html#using-grok-patterns-to-extract-data)

---

<div class="post-metadata">

**Author:** ![fnk](https://avatars.discourse-cdn.com/v4/letter/f/ac8455/32.png) [@fnk](https://community.graylog.org/u/fnk)\
**Post date:** [February 14, 2019, 4:57pm UTC](https://community.graylog.org/t/grok-formatting/8862/4 "2019-02-14T16:57:16Z")

</div>

Thanks, somehow missed that in the documentation, it’s been helpful. Much further but banging my head against the wall at the moment! So close though!

I’m using the following pattern which works…

> %{TIMESTAMP\_ISO8601} %{DATA:UNWANTED} %{USERNAME:UNWANTED} %{DATA:UNWANTED} %{DATA:UNWANTED} %{IPV4} %{PATH}

I need to extract the username between quotes from “The user ‘ServiceAccount’ has PASSED authentication.” To do this i’ve set a grok pattern up called JIRASECUSER which is the following regex

> (?\<=The user ').\*?(?=') DeleteEdit

Again this works in isolation as does the %{JIRASECUSER} on it’s own in the extractor.

As soon as I try to use the following the filter refuses to run:

> %{TIMESTAMP\_ISO8601} %{DATA:UNWANTED} %{USERNAME:UNWANTED} %{DATA:UNWANTED} %{DATA:UNWANTED} %{IPV4} %{PATH} %{JIRASECUSER}

Was looking for the server.log file on the OVA appliance but I can’t seem to find the log I need either.

Determined to get this sorted 😣

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 15, 2019, 9:40am UTC](https://community.graylog.org/t/grok-formatting/8862/5 "2019-02-15T09:40:19Z")

</div>

To find your logfile: [http://docs.graylog.org/en/2.5/pages/configuration/file\_location.html#omnibus-package](http://docs.graylog.org/en/2.5/pages/configuration/file_location.html#omnibus-package)

Check the docs …

* * *

Personal I would try to make the Grok Patterns, not that complex (you will want to modify the following and make it fit your local needs!)

```auto
%{TIMESTAMP_ISO8601:time} %{DATA:UNWANTED} - %{IPV4:request} %{PATH:path} %{GREEDYDATA:message} 

```

Check “capture named only” to have the following fields:

 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/bc06bbe8ee06495222823ff6776073eace9bd370.png)

As I do not know how other possible messages can look I did not extract the username from the field message - that should be done in a second Pattern on the field - this way you get always the basics and you are able to work with the real message separately.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 1, 2019, 9:40am UTC](https://community.graylog.org/t/grok-formatting/8862/6 "2019-03-01T09:40:20Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.