Grok Pattern Extractor Error

Graylog Central (peer support)
1

Hi,

i have a problem building my desired grok extractor. Following the docs I do:
Example Message:
<189>date=2021-06-22 time=10:21:36 devname=“HBG-FortiGate-4” devid=“FG4H0ETB20903009” eventtime=1624350097652764654 tz="+0200" logid=“0000000013” type=“traffic” subtype=“forward” level=“notice” vd=“CLIENT-VPN” srcip=10.64.0.7 srcport=42806 srcintf=“ssl.CLIENT-VPN” srcintfrole=“undefined” dstip=192.168.140.1 dstport=53 dstintf=“VLAN_296_C” dstintfrole=“lan” srccountry=“Reserved” dstcountry=“Reserved” sessionid=68230080 proto=17 action=“accept” policyid=31 policytype=“policy” poluuid=“d2b35750-bd4f-51eb-e05a-270fe16c392e” policyname=“DNS” user=“trasch” authserver=“LDAP-Grp-HBG” service=“DNS” trandisp=“noop” duration=180 sentbyte=86 rcvdbyte=147 sentpkt=1 rcvdpkt=1 appcat=“unscanned”

Working:

devname=%{NOTSPACE:Hostname}

Not working:

as soon as I put a second value into the pattern like mentioned in the doc section, it cannot extract anymore and run into an error:

devname={%NOTSPACE:Hostname} vd=%{NOTSPACE:vdom}

"Attention

We were not able to run the grok extraction. Please check your parameters."

What am I missing here.

Thanks and Regards

Christian

2

Hi @ibnetze
your GROK have to include all parts between one grok pattern and another, like strings, spaces, quotes, double quotes, braces etc.

Check this example:

devname=\"%{HOSTNAME:devname}\" devid=\"%{HOSTNAME:devid}\"
2 Likes
3

Hi shoothub,

thanks, your pattern works fine.
But i dont get it, why
devname="%{HOSTNAME:devname}" srcip="%{IPV4:sourceip}"

produces an error.

perhabs i need a grook pattern for dummies book.

Thanks and Cheers

Christian

4

Your grok doesn’t work because GROK is simplified regular expression, which should match complete string. In you example between devname=“XX” and src=“XY” there are other texts: devid="XX" eventtime=XX tz="XX" logid="XX" etc. So your grok need to contain also this text. If you don’t care about these text use simple %{GREEDYDATA:UNWANTED} which is like .*

So your grok would be:
devname="%{HOSTNAME:devname}" %{GREEDYDATA:UNWANTED} srcip="%{IPV4:sourceip}"

1 Like
5

thanks for lighting me up, shoothub, that did the magic trick

devname=%{NOTSPACE:vpnhost} %{GREEDYDATA:UNWANTED} vd=%{NOTSPACE:vdom} %{GREEDYDATA:UNWANTED} user=%{NOTSPACE:user} %{GREEDYDATA:UNWANTED} sentbyte=%{BASE10NUM:sent} rcvdbyte=%{BASE10NUM:rcvd}

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.