Cisco ASA grok parse failure

Elastic Stack Logstash
1

When I test this pattern on http://grokdebug.herokuapp.com/ it works however when I run it through logstash I get a _grokparsefailure

<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475

%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}: %ASA-6-305011: %{CISCO_ACTION:action} %{CISCO_XLATE_TYPE:xlate_type} %{WORD:protocol} translation from %{DATA:src_interface}:%{IP:src_ip}(/%{INT:src_port}) to %{DATA:src_xlated_interface}:%{IP:src_xlated_ip}/%{DATA:src_xlated_port}

{
           "message" => "<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475",
          "@version" => "1",
         "timestamp" => "Jun 17 2019 07:13:33",
              "host" => "b7-mint",
        "@timestamp" => 2019-06-16T22:42:06.684Z,
            "client" => "10.131.16.4",
        "syslog_pri" => "166",
              "tags" => [
            [0] "_grokparsefailure"
        ]
    }
2

Works fine in 7.1.1

       "src_interface" => "any",
          "xlate_type" => "dynamic",
"src_xlated_interface" => "outside131",
              "src_ip" => "192.168.192.35",
              "action" => "Built",
            "src_port" => "60475",
            "protocol" => "TCP",
       "src_xlated_ip" => "10.131.16.4",
           "timestamp" => "Jun 17 2019 07:13:33",
             "message" => "<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475",
          "syslog_pri" => "166"
3

Hi Badger,
That's what I'm using too. Do you mind sharing your logstash config?

4 
input { generator { count => 1 lines => [ '<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475' ] } }

filter {
    grok { match => { "message" => "%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}: %ASA-6-305011: %{CISCO_ACTION:action} %{CISCO_XLATE_TYPE:xlate_type} %{WORD:protocol} translation from %{DATA:src_interface}:%{IP:src_ip}(/%{INT:src_port}) to %{DATA:src_xlated_interface}:%{IP:src_xlated_ip}/%{DATA:src_xlated_port}" } }
}
output { stdout { codec => rubydebug { metadata => false } } }
5

Thanks Badger,

I am trying to use the patterns file


but having a hard time getting it to play

Should I start with a catch all message of %{GREEDYDATA} or
^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}

Do you have an example logstash config that incorporates this setup?

I will keep trying to work this out

6

I do not.

7

Thank you anyway. I am making some progress slowly

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.