Grok - How to extract substring

Graylog Central (peer support)
1

I’m using Grok to extract fields from my firewall’s Syslog messages. The source and destination IP addresses are formatted as follows…

src=10.2.1.1:137:X1 dst=192.168.254.202:137:X0

In addition to the IP address, the port number and firewall interface are also included. What I’d like to do is strip off the port and interface leaving just the IP address. I’ve tried the following but it fails to process…

src=%{IPV4:srcip}\:%{DATA:value0}

In short, using the example above, I’d like to save the source IP to the srcip field and discard everything else. Any help would be greatly appreciated.

Randy

2

If you don’t want to save named fields, don’t name it, and check option Only named captures in extractor, or option only_named_captures: true if you use pipeline function grok()

You can also add keyword UNWANTED for example %{BASE10NUM:UNWANTED} if you want to skip field

https://docs.graylog.org/en/3.3/pages/extractors.html#using-grok-patterns-to-extract-data

So your grok can be e.g.:
src=%{IPV4:srcip}:%{NUMBER:UNWANTED}:%{WORD:UNWANTED}

3

@shoothub
Thanks for the tip on using UNWANTED. I tried the example you gave but the test still will not process. Here’s the full Syslog message…

id=VNtz400 sn=XXXXXXXXXXXX time=“2020-07-09 13:04:33 UTC” fw=71.70.216.55 pri=1 c=32 m=608 msg=“IPS Detection Alert: INFO NetBIOS Name Request Probe” sid=8968 ipscat=“INFO NetBIOS Name Request Probe” ipspri=3 n=50791 src=10.2.1.1:137:X1 dst=192.168.254.202:137:X0 fw_action=“NA”

The extraction I’m testing follows…

sid=%{NUMBER:sid} ipscat=%{QUOTEDSTRING:ipscat} src=%{IPV4:srcip}:%{NUMBER:UNWANTED}:%{WORD:UNWANTED}

The first two - sid, ipscat - process fine. The third - src - does not. When I run the extractor test with src added, I get a message saying “We were not able to run the grok extraction. Please check your parameters.” I even changed the last field from WORD to HOSTNAME as the values include letters but this did not work either. Any other thoughts?

RS

4

There are another fields between ipscat and src, so you need to include in your grok:

sid=%{NUMBER:sid} ipscat=%{QUOTEDSTRING:ipscat} %{DATA:UNWANTED} src=%{IPV4:srcip}:%{NUMBER:UNWANTED}:%{WORD:UNWANTED}
5

WOW! Wouldn’t you know that my initial extraction used two back-to-back fields. THANKS for the help! This worked perfectly!

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.