# \#grok-patternspl **URL:** https://community.graylog.org/tag/grok-patternspl/13.md [Latest](https://community.graylog.org/latest.md) · [Categories](https://community.graylog.org/categories.md) · [Tags](https://community.graylog.org/tags.md) --- ## [Can I apply different grok pattern in single input?](https://community.graylog.org/t/can-i-apply-different-grok-pattern-in-single-input/36669)
**Author:** [@baalkchina](https://community.graylog.org/u/baalkchina)\ **Replies:** 1\ **Last updated:** [December 1, 2025, 11:19am UTC](https://community.graylog.org/t/can-i-apply-different-grok-pattern-in-single-input/36669 "2025-12-01T11:19:48Z")
Hi all, I am new to graylog, and I am trying to using graylog store and do some anylize in syslog. I had setting up a input (a syslog), and setting my firewall send session and nat logs to graylog server. Then I add an… --- ## [Replace "logcheck" by Graylog?](https://community.graylog.org/t/replace-logcheck-by-graylog/35887)
**Author:** [@ralfbergs](https://community.graylog.org/u/ralfbergs)\ **Replies:** 0\ **Last updated:** [June 23, 2025, 7:20am UTC](https://community.graylog.org/t/replace-logcheck-by-graylog/35887 "2025-06-23T07:20:03Z")
1. Purpose: I’m looking into replacing “logcheck” by Graylog. Currently I’m using “logcheck” on my Debian bare-metal server to become aware of events of interest. I’ve created an extensive regexp pattern list to suppres… --- ## [Use of ${QUOTEDSTRING} causes Graylog to seize - Part II](https://community.graylog.org/t/use-of-quotedstring-causes-graylog-to-seize-part-ii/34564)
**Author:** [@marziglt](https://community.graylog.org/u/marziglt)\ **Replies:** 22\ **Last updated:** [January 13, 2025, 4:06pm UTC](https://community.graylog.org/t/use-of-quotedstring-causes-graylog-to-seize-part-ii/34564 "2025-01-13T16:06:34Z")
1. Describe your incident: We are creating a grok pattern to parse a complex message that contains quoted strings with commas inside the quotes. Whenever we use the default ${QUOTEDSTRING} or ${QS} grok patterns against… --- ## [Creating GROK rule to parse across multiline log](https://community.graylog.org/t/creating-grok-rule-to-parse-across-multiline-log/34638)
**Author:** [@huimin](https://community.graylog.org/u/huimin)\ **Replies:** 0\ **Last updated:** [January 10, 2025, 8:39am UTC](https://community.graylog.org/t/creating-grok-rule-to-parse-across-multiline-log/34638 "2025-01-10T08:39:19Z")
1. Describe your incident: I am trying to write a pipeline rule that will extract value based on a grok pattern and set field. Sample log: An account failed to log on. Subject: Security ID: NULL SID Account Name: … --- ## [Unifi USG-3P firewall rules and GROK pattern](https://community.graylog.org/t/unifi-usg-3p-firewall-rules-and-grok-pattern/34475)
**Author:** [@schneich1](https://community.graylog.org/u/schneich1)\ **Replies:** 7\ **Last updated:** [December 24, 2024, 11:27pm UTC](https://community.graylog.org/t/unifi-usg-3p-firewall-rules-and-grok-pattern/34475 "2024-12-24T23:27:50Z")
Dear community, It has been almost 2 years, since a last did some work on my Graylog. It is running in a docker container and I keep it up-to-date. (currently on version 6.1.3) I get the syslog messages from my Unifi U… --- ## [Pipeline Rule: Issues with key\_value function (fields can be created in Simulator, but not in real time)](https://community.graylog.org/t/pipeline-rule-issues-with-key-value-function-fields-can-be-created-in-simulator-but-not-in-real-time/33447)
**Author:** [@bettels-uhi](https://community.graylog.org/u/bettels-uhi)\ **Replies:** 1\ **Last updated:** [September 5, 2024, 1:45pm UTC](https://community.graylog.org/t/pipeline-rule-issues-with-key-value-function-fields-can-be-created-in-simulator-but-not-in-real-time/33447 "2024-09-05T13:45:30Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Graylog Grok is not extracting data to a new field ](https://community.graylog.org/t/graylog-grok-is-not-extracting-data-to-a-new-field/33335)
**Author:** [@lungile](https://community.graylog.org/u/lungile)\ **Replies:** 3\ **Last updated:** [August 29, 2024, 1:29pm UTC](https://community.graylog.org/t/graylog-grok-is-not-extracting-data-to-a-new-field/33335 "2024-08-29T13:29:38Z")
Hi Community, Im new to graylog, Im having a challange to extract the following using the grok pattern, Im trying to extract the component to a new field. %{GREEDYDATA}\\s+%{GREEDYDATA:COMPONENT} sample Data : DURATION… --- ## [Issues with Cisco Grok pattern](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243)
**Author:** [@ffeingol](https://community.graylog.org/u/ffeingol)\ **Replies:** 5\ **Last updated:** [August 16, 2024, 8:15am UTC](https://community.graylog.org/t/issues-with-cisco-grok-pattern/33243 "2024-08-16T08:15:53Z")
I’m using the following Grok pattern to extra data from a Cisco device: %{GREEDYDATA:UNWANTED} %%{GREEDYDATA:cisco\_first}?-%{GREEDYDATA:cisco\_status}?-%{GREEDYDATA:cisco\_last}?: %{GREEDYDATA:cisco\_message} Example log … --- ## [Graylog Update to 6.0.5 (Graylog 6.0.5+3ef5be7) No longer able to use existing Grok Patterns](https://community.graylog.org/t/graylog-update-to-6-0-5-graylog-6-0-5-3ef5be7-no-longer-able-to-use-existing-grok-patterns/33220)
**Author:** [@secdoc](https://community.graylog.org/u/secdoc)\ **Replies:** 5\ **Last updated:** [August 8, 2024, 7:17pm UTC](https://community.graylog.org/t/graylog-update-to-6-0-5-graylog-6-0-5-3ef5be7-no-longer-able-to-use-existing-grok-patterns/33220 "2024-08-08T19:17:04Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Not able to use Grok pattern in Graylog but works in extractor](https://community.graylog.org/t/not-able-to-use-grok-pattern-in-graylog-but-works-in-extractor/32621)
**Author:** [@jhonbanegadon](https://community.graylog.org/u/jhonbanegadon)\ **Replies:** 3\ **Last updated:** [June 5, 2024, 3:46pm UTC](https://community.graylog.org/t/not-able-to-use-grok-pattern-in-graylog-but-works-in-extractor/32621 "2024-06-05T15:46:07Z")
Hi, I am trying to create a Grok pattern for a syslog: %SEC\_LOGIN-5-LOGIN\_SUCCESS: Login Success \[user: admin\] \[Source: 1.1.1.1\] \[localport: 22\] at 08:51:08 UTC Wed Jun 5 2024 and my grok pattern is below: Login Succe… --- ## [Pipeline performance optimization and metrics](https://community.graylog.org/t/pipeline-performance-optimization-and-metrics/32528)
**Author:** [@CJRoss](https://community.graylog.org/u/CJRoss)\ **Replies:** 2\ **Last updated:** [May 28, 2024, 3:52pm UTC](https://community.graylog.org/t/pipeline-performance-optimization-and-metrics/32528 "2024-05-28T15:52:46Z")
Instead of attempting to upgrade my 5.x server I created a new 6.0 server and I’m going through and reworking my pipelines and rules now that I’m a bit more familiar with Graylog. I’m also working on learning the rule w… --- ## [Process buffer 100% because an extractor](https://community.graylog.org/t/process-buffer-100-because-an-extractor/32219)
**Author:** [@lmrc](https://community.graylog.org/u/lmrc)\ **Replies:** 1\ **Last updated:** [May 2, 2024, 9:56am UTC](https://community.graylog.org/t/process-buffer-100-because-an-extractor/32219 "2024-05-02T09:56:45Z")
Hello, I have a problem with an extractor created in a filebeat input (Beats) The extractor has been created in the message field using a grok pattern to extract the path of a file in an HTTP POST request with the obje… --- ## [Grok parsing multi-value field from csv](https://community.graylog.org/t/grok-parsing-multi-value-field-from-csv/31889)
**Author:** [@uhoh\_pf](https://community.graylog.org/u/uhoh_pf)\ **Replies:** 4\ **Last updated:** [March 21, 2024, 7:27pm UTC](https://community.graylog.org/t/grok-parsing-multi-value-field-from-csv/31889 "2024-03-21T19:27:28Z")
I’m trying to parse a log line that contains a comma separated list of values for one key. The maximum count of values is variable there for not know before. My problem is that I only get the first an last value of that… --- ## [Pipeline rule not storing message](https://community.graylog.org/t/pipeline-rule-not-storing-message/31495)
**Author:** [@archem](https://community.graylog.org/u/archem)\ **Replies:** 9\ **Last updated:** [February 16, 2024, 12:11am UTC](https://community.graylog.org/t/pipeline-rule-not-storing-message/31495 "2024-02-16T00:11:28Z")
I am trying to get a pipeline working and can’t seem to get the rule to work properly. I have a separate input configured for all cisco switches. I then have a stream configured to match the gl2\_source\_input cisco swit… --- ## [Grok pattern for sophos xgs Firewall messages](https://community.graylog.org/t/grok-pattern-for-sophos-xgs-firewall-messages/31148)
**Author:** [@biller](https://community.graylog.org/u/biller)\ **Replies:** 1\ **Last updated:** [January 5, 2024, 1:37pm UTC](https://community.graylog.org/t/grok-pattern-for-sophos-xgs-firewall-messages/31148 "2024-01-05T13:37:54Z")
Hi, does anybody has an idea, what the mistakes could be in my grok pattern? I like to implement it in a graylog pipeline. I already spent some hours and have no clue, why the pattern does not work completely. here the… --- ## [Extractor causes low out message performance](https://community.graylog.org/t/extractor-causes-low-out-message-performance/30609)
**Author:** [@mka](https://community.graylog.org/u/mka)\ **Replies:** 5\ **Last updated:** [November 14, 2023, 4:26pm UTC](https://community.graylog.org/t/extractor-causes-low-out-message-performance/30609 "2023-11-14T16:26:59Z")
1. Describe your incident: If we create an extractor on one of our inputs our out log performance goes down with something like 99%. Right now our in and out is around 5000 to 12000 messages. If i create this extrator o… --- ## [Unwanted Grok Fields](https://community.graylog.org/t/unwanted-grok-fields/30455)
**Author:** [@dmill](https://community.graylog.org/u/dmill)\ **Replies:** 5\ **Last updated:** [October 31, 2023, 2:06pm UTC](https://community.graylog.org/t/unwanted-grok-fields/30455 "2023-10-31T14:06:26Z")
Hi there. I’m fairly new to the Graylog environment and log manipulation in general. I have been working to try and create extractors using Grok patterns for my router’s syslog. When I use a built-in Grok Pattern such as… --- ## [Search for messages with failed grok parser](https://community.graylog.org/t/search-for-messages-with-failed-grok-parser/29230)
**Author:** [@ulischell](https://community.graylog.org/u/ulischell)\ **Replies:** 5\ **Last updated:** [June 21, 2023, 5:32pm UTC](https://community.graylog.org/t/search-for-messages-with-failed-grok-parser/29230 "2023-06-21T17:32:41Z")
Hello, sorry for being a noob here, but i tried searching for on how to find messages in a stream where the grok parser did not match. logstash had tags for that, i wonder if i can create a field within grok if nothing … --- ## [To\_long function returning "0"](https://community.graylog.org/t/to-long-function-returning-0/28824)
**Author:** [@OgreSasqwatch](https://community.graylog.org/u/OgreSasqwatch)\ **Replies:** 4\ **Last updated:** [May 18, 2023, 3:30pm UTC](https://community.graylog.org/t/to-long-function-returning-0/28824 "2023-05-18T15:30:39Z")
1. Describe your incident: I am trying to use a pipeline to parse out the UNIX timestamp from a Meraki MX firewall flow log. I almost have it, but the to\_long function is converting the value to “0”. 2. Describe your e… --- ## [Graylog 5 does not search through custom fields correctly](https://community.graylog.org/t/graylog-5-does-not-search-through-custom-fields-correctly/28745)
**Author:** [@dtwhe](https://community.graylog.org/u/dtwhe)\ **Replies:** 3\ **Last updated:** [May 12, 2023, 8:00am UTC](https://community.graylog.org/t/graylog-5-does-not-search-through-custom-fields-correctly/28745 "2023-05-12T08:00:33Z")
When using Search, I want to filter only through my custom field DstPrt, but it shows results from origin message instead. Graylog server is receiving local firewall logs from Windows stations in form of a string messag… --- ## [Log Extractor Help](https://community.graylog.org/t/log-extractor-help/28398)
**Author:** [@robsch56](https://community.graylog.org/u/robsch56)\ **Replies:** 1\ **Last updated:** [April 10, 2023, 9:36pm UTC](https://community.graylog.org/t/log-extractor-help/28398 "2023-04-10T21:36:17Z")
I am new to Graylog, so please be gentle. OS: Debian 11 Version : Graylog v5.0.6 I am pulling in logs from Cimtrak; I have the input setup and the logs are comming in. So I am trying to setup an extractor, so they are… --- ## [Grok extractor pattern help](https://community.graylog.org/t/grok-extractor-pattern-help/28351)
**Author:** [@mobarzik](https://community.graylog.org/u/mobarzik)\ **Replies:** 4\ **Last updated:** [April 7, 2023, 1:55pm UTC](https://community.graylog.org/t/grok-extractor-pattern-help/28351 "2023-04-07T13:55:27Z")
Hi! I’m new to graylog and I’m having trouble trying to extract data from my log lines via a Grok extractor My log lines are semicolon separated lists like this: timestamp;uid;ip;useragent;url … So I created a grok pa… --- ## [Fortigate Grok pattern work not well](https://community.graylog.org/t/fortigate-grok-pattern-work-not-well/27850)
**Author:** [@michaal1511](https://community.graylog.org/u/michaal1511)\ **Replies:** 8\ **Last updated:** [February 28, 2023, 12:22pm UTC](https://community.graylog.org/t/fortigate-grok-pattern-work-not-well/27850 "2023-02-28T12:22:04Z")
1. Describe your incident: I collect logs from fortigate. Logs as raw text UDP. I have message where have all information (ip, action, policy, type ect.) I trying use grok pattern for extract all this information to … --- ## [Process IIS Logs with GROK patterns and Extractor (or Pipeline Rule)](https://community.graylog.org/t/process-iis-logs-with-grok-patterns-and-extractor-or-pipeline-rule/27723)
**Author:** [@wolfgang.reidlinger](https://community.graylog.org/u/wolfgang.reidlinger)\ **Replies:** 5\ **Last updated:** [February 15, 2023, 4:32pm UTC](https://community.graylog.org/t/process-iis-logs-with-grok-patterns-and-extractor-or-pipeline-rule/27723 "2023-02-15T16:32:35Z")
Hi there, trying to process IIS logs with GROK patterns. Found this here in the forum but didn’t really worked. https://community.graylog.org/t/sidecar-filebeat-and-iis-logs/7974/4 %{TIMESTAMP\_ISO8601:datetime} %{IP… --- ## [Netgear Log - Grok Patern](https://community.graylog.org/t/netgear-log-grok-patern/25792)
**Author:** [@Alewx](https://community.graylog.org/u/Alewx)\ **Replies:** 6\ **Last updated:** [September 21, 2022, 1:57pm UTC](https://community.graylog.org/t/netgear-log-grok-patern/25792 "2022-09-21T13:57:00Z")
Hello to all, I’m a french new user of Graylog and I work with Netgear logs. Some fields of these logs are not good. When we connect to a Netgear Switch, the log look like : So all the informations that we want to … --- ## [How to get only certain data from grok/regex?](https://community.graylog.org/t/how-to-get-only-certain-data-from-grok-regex/25204)
**Author:** [@gmorin](https://community.graylog.org/u/gmorin)\ **Replies:** 5\ **Last updated:** [August 12, 2022, 1:56pm UTC](https://community.graylog.org/t/how-to-get-only-certain-data-from-grok-regex/25204 "2022-08-12T13:56:55Z")
Hi everyone, I’m trying to extract data from UFW logs using regex/GROK but I can’t find how to get only the data I want. Maybe some of you could help me to see clear through these tools ? This is the log I’m trying to … --- ## [Help parse CEF2 Logs - SentinelOne](https://community.graylog.org/t/help-parse-cef2-logs-sentinelone/24730)
**Author:** [@glaubercastelani](https://community.graylog.org/u/glaubercastelani)\ **Replies:** 12\ **Last updated:** [July 14, 2022, 1:38pm UTC](https://community.graylog.org/t/help-parse-cef2-logs-sentinelone/24730 "2022-07-14T13:38:23Z")
Hello guys, I have a graylog environment receiving logs from my SentinelOne XDR console, but I am not able to parser the logs. The logs received are CEF2. Here is a sample of the logs received: 20:34:57,360 sentinel… --- ## [Parsing Account Name field](https://community.graylog.org/t/parsing-account-name-field/24626)
**Author:** [@noexistin](https://community.graylog.org/u/noexistin)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 3:38pm UTC](https://community.graylog.org/t/parsing-account-name-field/24626 "2022-07-05T15:38:07Z")
Hello everyone, I want to parse Account Name field in Windows Security Logs. So i was try to parse with Grok patterns and also regular expression but i failed. If anyone can help me about it, i will be so appreciative. … --- ## [Receiving messages are stopping when running set\_fields in pipeline](https://community.graylog.org/t/receiving-messages-are-stopping-when-running-set-fields-in-pipeline/23278)
**Author:** [@Nklimko](https://community.graylog.org/u/Nklimko)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 10:30pm UTC](https://community.graylog.org/t/receiving-messages-are-stopping-when-running-set-fields-in-pipeline/23278 "2022-03-31T22:30:41Z")
Hi! I have some troubles with using grok patterns in Graylog pipelines. I have a simple test rule to parse message field: rule "pipeline" when true then set\_field("pipeline","true"); let mess = to\_string($… --- ## [Pipllines and the grok-function](https://community.graylog.org/t/pipllines-and-the-grok-function/22341)
**Author:** [@ihe](https://community.graylog.org/u/ihe)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 3:07pm UTC](https://community.graylog.org/t/pipllines-and-the-grok-function/22341 "2022-01-19T15:07:32Z")
I am trying to use the grok-function in a pipline. But I’m failing. I do not mean the Grok-function in the Inputs, my plan is to use pipelines to extract data with Groks as described here. 2. Describe your environment: … [Next page](https://community.graylog.org/tag/grok-patternspl/13.md?match_all_tags=true&page=1&tags%5B%5D=grok-patternspl)