~105 Cisco Grok pattern key/field names

There are ~105 distinct Cisco types extracted from the log messages (+/- a few generics).

I'm asking this question because I ran into this issue with some custom fields.

Is there a functional difference between interface and interface_name? Or proto or protocol?

Can they and/or should they be consolidated?

1 Like