Grok Pattern doesn't execute

Graylog Central (peer support)
1

Hi everyone,

I have an issue with Grok pattern on Graylog.

Here is an log message I want to extract :

9999-01-07T23:12:43+02:00 9999 00.00.00.00 stm[9999]: <999999> <00.00.00.00 FF:FF:FF:FF:FF:FF> Dropping the radius packet for Station FF:FF:FF:FF:FF:FF FF:FF:FF:FF:FF:FF doing 802.1x

I use Grok Debugger website to create my Grok pattern. Here is my grok input :

%{TIMESTAMP_ISO8601:Date} %{BASE10NUM} %{IPV4:Host_ipaddress} %{DATA:error_location}: <%{DATA:error_id}> <%{DATA:log_level}> <%{DATA} %{COMMONMAC:Host_macaddress}> [%{SPACE}]%{GREEDYDATA:message}

It’s not the most optimized code but it’s worked on website. If I put this Grok pattern on Graylog, he give me this message :

“Attention
We were not able to run the grok extraction. Please check your parameters.”

If I dsable the “Named captures only” option it’s worked but there are some information I don’t want. And my Grok pattern are created with this parameter

Do you know where is the issue ?

Thank in advance and happy holidays !

2

What’s in the logs of your Graylog node(s) when trying to use that Grok pattern?

Have all Grok patterns used in your extractor been added to Graylog? Check in System / Grok patterns.

3

Hi Jochen and Happy New Year !

I checked the server.log and I have no error on the log file :confused:

All pattern use in the extractor exist in Graylog so the issue is not there.

Thank you for your help.

4

Please provide to full configuration of the Grok extractor, a dump of the MongoDB collection “grok_patterns”, and a few example messages so that we can try to reproduce your problem.

5

Here is a download link for all the elements you asked for :

http://fromsmash.com/362f571c-f0a4-11e7-830d-0a39043893bc

Thank you.

6

Hi,
based on your log message:

  • in your grok pattern i see <%{DATA:log_level}> but there’s no string match in your log message.

  • remember to always quote special chars like “<” or “>”

  • instead of [%{SPACE}] (and i didn’t see any “[” or “]” matching in message) use always (?:%{SPACE}) if you don’t know if whitespace is present or no.

I tried this on my GL2.4:

%{TIMESTAMP_ISO8601:Date} %{BASE10NUM} %{IPV4:Host_ipaddress} %{DATA:error_location}: \<%{DATA:error_id}\> \<%{DATA} %{COMMONMAC:Host_macaddress}\>(?:%{SPACE})%{GREEDYDATA:message}

and

wGE203C.png1515×729 57.5 KB

Hope this helps :thinking:
and my apologies for my english :wink:

7

Hi zionio !

I have tested and it’s worked. Thanks for yours advices :wink:

For the DATA:error_log, it’s present on the real log. When I modified the line, I may delete it. I add it and it appear normaly.

Thank you really much and happy new year.

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.