Search code examples
logstashlogstash-grok

Grok Filter want to see only the processname

I want to see only the Process cmd.exe.

Example:

New Process Name: C:\Windows\System32\cmd.exe  Token Elevation Type: %%1938  Creator Process ID: 0x1a0`enter code here`

Grok Filter:

New Process Name: %{GREEDYDATA}\\%{GREEDYDATA:Process}

Output:

{
  "Process": [
    [
      "cmd.exe  Token Elevation Type: %%1938  Creator Process ID: 0x1a0`enter code here`"
    ]
  ]
}

How i get to see only cmd.exe and not Token Elevation Type: %%1938 Creator Process ID: 0x1a0`enter?

Solution

  • GREEDYDATA usually means "everything". I find it usually not be useful except at the end of a pattern (as a catch-all).

    So, you're asking for everything after the backslash, which is what you're getting.

    How about:

    New Process Name: %{GREEDYDATA}\\%{NOTSPACE:Process}