# Issues with Cisco Grok pattern **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** regex-special-charac, grok-patternspl\ **Created:** [August 12, 2024, 9:35pm UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243 "2024-08-12T21:35:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ffeingol](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ffeingol/32/16691_2.png) [@ffeingol](https://community.graylog.org/u/ffeingol)\ **Post date:** [August 12, 2024, 9:35pm UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243/1 "2024-08-12T21:35:56Z")
I’m using the following Grok pattern to extra data from a Cisco device: ```auto %{GREEDYDATA:UNWANTED} %%{GREEDYDATA:cisco_first}?-%{GREEDYDATA:cisco_status}?-%{GREEDYDATA:cisco_last}?: %{GREEDYDATA:cisco_message} ``` Example log data looks like this: ```auto Aug 12 21:16:00.410: %IPV6_ACL-6-ACCESSLOGDP: list XXXXXXXX/30 permitted icmpv6 :: -> ``` The pattern works fine on IPV4 related messages, but on an IPV6 record it’s matching on the colon after icmpv6 and not after ACCESSLOGDP like I’d like. We’re running Graylog V6.0.5. It’s running on Ubuntu with the latest version of Elasticsearch. I’m basically looking for a Grok pattern that will match “%IPV6\_ACL-6-ACCESSLOGDP:” in the log record. Thanks! ---
**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\ **Post date:** [August 14, 2024, 3:32pm UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243/2 "2024-08-14T15:32:37Z")
@ffeingol The below… %{GREEDYDATA:UNWANTED} %%{DATA:cisco\_first}: %{GREEDYDATA:cisco\_message} Matches these examples Aug 12 21:16:00.410: %IPV6\_ACL-6-ACCESSLOGDP: list XXXXXXXX/30 permitted icmpv6 Aug 12 21:16:00.410: %SEC-6-IPACCESSLOGP: list INTERNET-IN denied udp 88.89.209.63(137) → 1.2.3.4(137), 1 packet Did you need to further break the message down into fields? ---
**Author:** ![ffeingol](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ffeingol/32/16691_2.png) [@ffeingol](https://community.graylog.org/u/ffeingol)\ **Post date:** [August 15, 2024, 2:56am UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243/3 "2024-08-15T02:56:26Z")
> [@ffeingol](#): > > `%IPV6_ACL-6-ACCESSLOGDP:` This is what I’m trying to parse. It’s in the format FIRST\_PART-STATUS-LAST\_PART. It begins with a % (perecent sign) an ends with a : (colon). The issue is that my patterns is matching on the colon in the IPV6 address, not the ending colon on the LAST\_PART. ---
**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\ **Post date:** [August 15, 2024, 8:22am UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243/4 "2024-08-15T08:22:36Z")
@ffeingol Try replacing GREEDYDATA with DATA as below, you can end the pattern with $ to capture the remaining. %{DATA:UNWANTED}: %(%{DATA:cisco\_first}:)? (%{DATA:Thing})? (%{DATA:Thing2})? (%{WORD:Thing3})? (%{WORD:Thing4})? ---
**Author:** ![ffeingol](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ffeingol/32/16691_2.png) [@ffeingol](https://community.graylog.org/u/ffeingol)\ **Post date:** [August 15, 2024, 1:38pm UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243/5 "2024-08-15T13:38:34Z")
That’s exactly what I was looking for, so thank you. Is the some documentation on the {DATA}, {WORD} etc. I can see the patters in Grok patters, but some doc on using them would help. ---
**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\ **Post date:** [August 16, 2024, 8:15am UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243/6 "2024-08-16T08:15:53Z")
@ffeingol Happy to help. I’m not finding anything akin to a cheatsheet which would give quick and valuable insight, what I’ve learnt has come from googling. By far the best tool when creating a pattern would be [https://grokdebugger.com/](https://grokdebugger.com/) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 30, 2024, 8:16am UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243/7 "2024-08-30T08:16:31Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.