GROK Pattern Collection
UPDATED FOR 3.0.2, the final 2.0.x version is tagged 2.0
This is a collection of GROK patterns to help get going.
Currently included:
BASE10NUM
BASE16FLOAT
BASE16NUM
CISCOMAC
COMBINEDAPACHELOG
COMMA
COMMONAPACHELOG
COMMONMAC
DATA
DATE
DATE_EU
DATE_US
DATE_US2
DATESTAMP
DATESTAMP_EVENTLOG
DATESTAMP_OTHER
DATESTAMP_RFC2822
DATESTAMP_RFC822
DAY
GREEDYDATA
HOST
HOSTNAME
HOSTPORT
HOUR
HTTPDATE
INT
IP
IPORHOST
IPV4
IPV6
ISO8601_TIMEZONE
LOGLEVEL
MAC
MINUTE
MONTH
MONTHDAY
MONTHNUM
MONTHNUM2
NONNEGINT
NOTCOMMA
NOTSPACE
NUMBER
PATH
POSINT
PROG
PROTOCOL
QS
QSORNC
QUOTEDQUOTES
QUOTEDSTRING
QUOTES
SECOND
SPACE
SYSLOGBASE
SYSLOGFACILITY
SYSLOGHOST
SYSLOGPROG
SYSLOGTIMESTAMP
TIME
TIMESTAMP_ISO8601
TTY
TZ
UNIXPATH
URI
URIHOST
URIPARAM
URIPATH
URIPATHPARAM
URIPROTO
USER
USERNAME
UUID
WINDNS_FLAGSCHAR
WINDNS_FLAGSHEX
WINDNS_IP
WINDNS_OPCODE
WINDNS_PROTOCOL
WINDNS_QTYPE
WINDNS_QUERYRESP
WINDNS_RESPONSE
WINDNS_SNDRCV
WINDNS_THREADID
WINDNS_TIME
WINDOWSMAC
WINPATH
WORD
WORDSWITHDASH
YEAR
@xstnc: You can import these in the System -> Grok Patterns section of the Graylog web interface.