# Centralized Syslog management for Cisco Switches **URL:** \ **Category:** Logstash\ **Created:** [January 23, 2020, 1:17pm UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253 "2020-01-23T13:17:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![xkazuuma](https://avatars.discourse-cdn.com/v4/letter/x/90ced4/32.png) [@xkazuuma](https://discuss.elastic.co/u/xkazuuma)\ **Post date:** [January 23, 2020, 1:17pm UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253/1 "2020-01-23T13:17:11Z")
Hello everyone! I set up an ELK-Stack which is already running, receiving some logs and also showing everything in kibana. But I have problems with the filtering and properly use of the data because everything is just in the "message" of the received data. Here a screenshot as explanation: ![elk_switch_data](https://us1.discourse-cdn.com/elastic/original/3X/7/1/7104821dc665dd980c755f453a23b98dfec5d353.png) With this data I cant really create any diagramms or analysis. I was trying to figure out the mapping thing but didnt had any succes yet.. Also I m not sure if I m on the right way with that.. Switch sends log to ELK-Stack IP -\> rsyslog receives log over Port 514 -\> logstash filters data through filebeat (config below) -\> data visible in kibana like in screenshot above Can anyone tell me how I can fix this problem? I want to separate the message block in syslog host (for example switch-412) and the log message from the switch. Logstash Config: > ``` > input { > beats { > port => 5044 > } > } > > filter { > if [type] == "syslog" { > grok { > match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } > add_field => ["received_at", "%{@timestamp}"] > add_field => ["received_from", "%{host}"] > } > syslog_pri { } > date { > match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] > } > } > } > > output { > elasticsearch { > hosts => ["ELK-IP:9200"] > manage_template => false > index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" > document_type => "%{[@metadata][type]}" > } > } > > ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 23, 2020, 3:44pm UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253/2 "2020-01-23T15:44:10Z")
What does the message field look like? ---
**Author:** ![xkazuuma](https://avatars.discourse-cdn.com/v4/letter/x/90ced4/32.png) [@xkazuuma](https://discuss.elastic.co/u/xkazuuma)\ **Post date:** [January 24, 2020, 6:13am UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253/3 "2020-01-24T06:13:43Z")
Hello Badger, here some examples how the message part looks, when I m searching for "_switch-_": ![switch_message_example](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43cedf8fb79d0aa2e7cc540210f447c511d37497.png) ---
**Author:** ![Flavio\_Pompermaier](https://avatars.discourse-cdn.com/v4/letter/f/54ee81/32.png) [@Flavio\_Pompermaier](https://discuss.elastic.co/u/Flavio_Pompermaier)\ **Post date:** [January 24, 2020, 9:00am UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253/4 "2020-01-24T09:00:44Z")
This is what I use to parse those logs with logstash. It would be nice if an equivalent ISE fileset would be added to [CISCO module in filebeat](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-cisco.html) ``` filter { mutate { rename => { "host" => "host.ip" } add_field => { "host.name" => "%{host.ip}"} } grok { match => { "message" => [ #<181>Dec 20 15:11:30 bbbb CISE_Passed_Authentications 0000003579 7 0 2019-12-20 15:11:30.539 +00:00 0098113147 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=79, Device IP Address=10.2.80.103, DestinationIPAddress=10.1.128.144, DestinationPort=1812, UserName=DOMAIN\\AAA, Protocol=Radius, RequestLatency=12, NetworkDeviceName=XXXX, User-Name=XXX, NAS-IP-Address=10.2.80.103, NAS-Port=50148, Service-Type=Framed, Framed-IP-Address=10.2.10.63, Framed-MTU=1500, State=37CPMSessionID=0A0250670000411C24734840\;33SessionID=bbbb/364024023/9139809\;, Called-Station-ID=B4-A8-B9-FA-FE-30, Calling-Station-ID=28-00-A8-08-CD-00, NAS-Port-Type=Ethernet, NAS-Port-Id=GigabitEthernet1/0/48, EAP-Key-Name=, cisco-av-pair=service-type=Framed, cisco-av-pair=audit-session-id=0A0250670000411C24734840, cisco-av-pair=method=dot1x, cisco-av-pair=vlan-id=10, NetworkDeviceProfileName=Cisco, NetworkDeviceProfileId=b0699505-3150-1115-a80e-6753d45bf11c, IsThirdPartyDeviceFlow=false, "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP} %{SYSLOGHOST:logsource} %{DATA:ise.log_type} %{NUMBER:ise.log_sequence} %{INT:ise.log_lines_split} %{INT:ise.log_line_sequence} %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})? %{ISO8601_TIMEZONE}? %{NUMBER:ise.log_number} %{NUMBER:ise.log_id} %{DATA:ise.log_severity} %{DATA:ise.log_id_description},%{GREEDYDATA:kvfields}", #<181>Dec 20 16:53:56 bbbb CISE_Passed_Authentications 0000003629 3 1 AcsSessionID=bbbb/364024023/9165172, AuthenticationIdentityStore=Internal Endpoints, AuthenticationMethod=Lookup, SelectedAccessService=Default Network Access, SelectedAuthorizationProfiles=VLAN_Thinclient, UseCase=Host Lookup, Step=11001, Step=11017, Step=11027, Step=15049, Step=15008, Step=15048, Step=15041, Step=15013, Step=24209, Step=24211, Step=22037, Step=24715, Step=15036, Step=15048, Step=15048, Step=15048, Step=15048, Step=15016, Step=11002, SelectedAuthenticationIdentityStores=Internal Endpoints, AuthenticationStatus=AuthenticationPassed, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, NetworkDeviceGroups=Location#All Locations, NetworkDeviceGroups=Device Type#All Device Types, IdentityPolicyMatchedRule=Default, AuthorizationPolicyMatchedRule=ThinClient, UserType=Host, CPMSessionID=0A0250690000229EBCD5C02B, EndPointMACAddress=D0-00-00-00-A2-0A, PostureAssessmentStatus=NotApplicable, EndPointMatchedProfile=Unknown, "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP} %{SYSLOGHOST:logsource} %{DATA:ise.log_type} %{NUMBER:ise.log_sequence} %{INT:ise.log_lines_split} %{INT:ise.log_line_sequence} %{GREEDYDATA:kvfields}" ] } add_tag => ["cisco_ise"] tag_on_failure => [] } if "cisco_ise" in [tags] { kv { field_split => ", " value_split => "=" # trim_key => "\s" source => "kvfields" # remove_tag => ["cisco_ise"] } mutate { remove_field => ["kvfields"] } } else { grok { match => { "message" => [ #<189>116006: Dec 5 17:26:09.511: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet3/0/6, changed state to up #<189>128327: Dec 12 09:00:31.541: %ILPOWER-5-IEEE_DISCONNECT: Interface Gi2/0/6: PD removed (DDDADSW03-2) "^<%{POSINT:syslog_pri}>%{INT}: %{SYSLOGTIMESTAMP:syslog.timestamp}: %%{CISCO_REASON:cisco.facility}-%{INT:cisco.severity_level}-%{CISCO_REASON:cisco.facility_mnemonic}: %{GREEDYDATA:message}", #<14>Dec 5 18:25:26 ddddcrs01 Webdav Event: download, Path: /some/path/27-Mar -2019.pdf, File/Folder: File, Size: 82.90 KB, User: DOMAIN\xxx, IP: 172.16.0.150 #<14>Dec 12 12:02:00 ddddcrs01 Webdav Event: upload, Path: /some/path/27-Mar -2019.pdf, File/Folder: File, Size: 643.10 KB, User: DOMAIN\xxx, IP: 172.16.0.150 "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP} %{SYSLOGHOST:logsource} %{DATA:service}: %{WORD:action}, Path: (%{GREEDYDATA:path_src} -> %{GREEDYDATA:path_dst}|%{GREEDYDATA:path_dst}), File/Folder: %{WORD:path_type}(?:, Size: (NA|%{BASE10NUM:file_size} %{WORD:file_size_unit}))?(?:, User: (?:%{WORD:user.domain}\\)?%{USERNAME:user.name})?(?:, IP: %{IP:source.ip})?", #<14>Dec 12 10:01:03 ddddcrs01 Connection: User [DOMAIN\xxx] from [DDD0886(10.2.10.68)] via [CIFS(SMB2)] accessed shared folder [fff_share] "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP} %{SYSLOGHOST:logsource} %{WORD:service}: User \[(%{IPORHOST:user.domain})?\\?%{DATA:user.name}\] from \[(%{IPORHOST:source.domain})?\\?\(%{IPORHOST:source.ip}\)\] via \[%{WORD:sharing.protocol_dialect}\(%{WORD:sharing.protocol}\)\] accessed shared folder \[%{DATA:sharing.target_folder}\]", #<12>Dec 20 15:38:04 ddddcrs01 Connection: User [DOMAIN\xxx] from [172.16.0.150] failed to log in via [WebDAV] due to authorization failure. "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP} %{SYSLOGHOST:logsource} %{DATA:service}: User \[(?:%{IPORHOST:user.domain})\\?%{DATA:user.name}\] from \[(%{IPORHOST:source.domain})?\\?%{IPORHOST:source.ip}\] failed to log in via \[(%{WORD:sharing.protocol_dialect})?\\?%{WORD:sharing.protocol}\] due to authorization failure" ] } } } syslog_pri { use_labels => true } } ``` ---
**Author:** ![xkazuuma](https://avatars.discourse-cdn.com/v4/letter/x/90ced4/32.png) [@xkazuuma](https://discuss.elastic.co/u/xkazuuma)\ **Post date:** [January 24, 2020, 12:48pm UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253/5 "2020-01-24T12:48:43Z")
Thanks for your answer! This looks good and I wanted to instantly try it out. Sadly I realised that I dont even have the cisco module for filebeat neighter can I activate it. Here how it look on the server at /etc/filebeat/modules.d ![elk_filebeat_modules](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a1e631e3c80a8ace31e2e91ab24da6bef5f71e3.png) I tried to activate the module with the description in the link you send. How can I install the module if it is not there? Couldnt find any download link or description. All descriptions are for enabling it. Thanks in advance! ---
**Author:** ![Flavio\_Pompermaier](https://avatars.discourse-cdn.com/v4/letter/f/54ee81/32.png) [@Flavio\_Pompermaier](https://discuss.elastic.co/u/Flavio_Pompermaier)\ **Post date:** [January 24, 2020, 1:48pm UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253/6 "2020-01-24T13:48:35Z")
The Cisco module is available in Filebeat since some version of ES 7.x (I don't know the exact version). I think you're beat version is quite outdated, right? However this fileset (ISE) of Cisco Filebeat module is missing so I had to send logs via Syslog on Logstash (on some port) and then parse the Syslog lines directly. If ES would ever publish a Filebeat module to parse Cisco ISE logs you could run a Filebeat that listen for Syslog inputs activating the Cisco module and properly configuring an ise section. Unfortunately this in not present at the moment, you should use the Logstash filters I pasted above. Here's the missing input part of my Logstash file: ``` input { tcp { port => 5000 } udp { port => 5000 } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2020, 1:48pm UTC](https://discuss.elastic.co/t/centralized-syslog-management-for-cisco-switches/216253/7 "2020-02-21T13:48:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.