I have been working on taking my samba vfs full_audit logs and processing them with grok and moving them on to an ELK stack.

I have added the following to my global samba conf:

    full_audit:prefix = %u|%U|%I|%m|%S|%T|%D
    full_audit:success = mkdir rename unlink rmdir pwrite
    full_audit:failure = connect
    full_audit:facility = local1
    full_audit:priority = NOTICE INFO

So I have logs which come out something like:

    Oct 30 20:22:04 localhost smbd[27520]: stock|stock||HOSTNAME|adminstorage|2014/10/30 20:22:04|STOCKBOX|rename|ok|Media/config.txt|.recycle/stock/Media/config.txt

Using the following:

mutate {
  gsub => ["message","\|"," "]

I remove the pipes between my characters and replace them with spaces so that grok can handle it. Leaving me with:

    Oct 30 20:22:04 localhost smbd[27520]: stock stock HOSTNAME adminstorage 2014/10/30 20:22:04 STOCKBOX rename ok Media/config.txt .recycle/stock/Media/config.txt

At the moment I am using the following grok pattern:

%{MONTH:syslog_month} %{MONTHDAY:syslog_day} %{TIME:syslog_time} localhost smbd\[%{INT:pid}\]: %{USER:user_service} %{USER:user_session} %{IP:client_ip} %{HOST:client_NETBIOS} %{GREEDYDATA:name_of_service} %{YEAR:samba_year}/%{MONTHNUM:samba_month}/%{MONTHDAY:samba_day} %{TIME:samba_time} %{USER:domain} %{WORD:action} %{WORD:sucess} %{GREEDYDATA:path}

At the end I am relying on GREEDYDATA to hoover up the path, as it's missing it's leading characters, it doesn't get picked up by PATH or anything else I can think to use. Do I need to write my own filter, or am I missing something? The reason it matters is if you are doing a rename, you get with 2 paths, and I would quite like to be able to spilt the 2 if possible. Since they can have spaces in the paths, and the thing that splits them is also a space how can I separate them?

1 Answer 1


As soon as I finished writing it all out it came to me, simply changing the mutate to replace with a comma, or other similar character should solve the issue


I ended up choosing ":" instead of commas, this cannot be used in a file name and works fine with the new grok:

filter {
    mutate {
      gsub => ["message","\|",":"]
    grok {
      match => { "message" => "%{MONTH:syslog_month} %{MONTHDAY:syslog_day} %{TIME:syslog_time} localhost smbd\[%{INT:pid}\]: %{USER:user_service}:%{USER:user_session}:%{IP:client_ip}:%{HOSTNAME:client_NETBIOS}:%{GREEDYDATA:name_of_service}:%{YEAR:samba_year}/%{MONTHNUM:samba_month}/%{MONTHDAY:samba_day} %{TIME:samba_time}:%{HOST:domain}:%{WORD:action}:%{WORD:sucess}:%{SAMBAFILES}" }

Using the following pattern:

SAMBAFILES (?:%{GREEDYDATA:file_start}:%{GREEDYDATA:file_end}|%{GREEDYDATA:file_position})

This works fine under testing so far

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .