# Cisco ASA grok parse failure
**URL:** https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168
**Category:** Logstash
**Created:** [June 18, 2019, 1:20am UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168 "2019-06-18T01:20:33Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [June 18, 2019, 1:20am UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/1 "2019-06-18T01:20:33Z")
When I test this pattern on [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) it works however when I run it through logstash I get a \_grokparsefailure
`<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475`
> %{POSINT:syslog\_pri}\>%{CISCOTIMESTAMP:timestamp}: %ASA-6-305011: %{CISCO\_ACTION:action} %{CISCO\_XLATE\_TYPE:xlate\_type} %{WORD:protocol} translation from %{DATA:src\_interface}:%{IP:src\_ip}(/%{INT:src\_port}) to %{DATA:src\_xlated\_interface}:%{IP:src\_xlated\_ip}/%{DATA:src\_xlated\_port}
```
{
"message" => "<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475",
"@version" => "1",
"timestamp" => "Jun 17 2019 07:13:33",
"host" => "b7-mint",
"@timestamp" => 2019-06-16T22:42:06.684Z,
"client" => "10.131.16.4",
"syslog_pri" => "166",
"tags" => [
[0] "_grokparsefailure"
]
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 18, 2019, 2:04pm UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/2 "2019-06-18T14:04:30Z")
Works fine in 7.1.1
```
"src_interface" => "any",
"xlate_type" => "dynamic",
"src_xlated_interface" => "outside131",
"src_ip" => "192.168.192.35",
"action" => "Built",
"src_port" => "60475",
"protocol" => "TCP",
"src_xlated_ip" => "10.131.16.4",
"timestamp" => "Jun 17 2019 07:13:33",
"message" => "<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475",
"syslog_pri" => "166"
```
---
### Author:  [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [June 18, 2019, 9:32pm UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/3 "2019-06-18T21:32:52Z")
Hi Badger,
That's what I'm using too. Do you mind sharing your logstash config?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 18, 2019, 10:25pm UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/4 "2019-06-18T22:25:00Z")
```
input { generator { count => 1 lines => ['<166>Jun 17 2019 07:13:33: %ASA-6-305011: Built dynamic TCP translation from any:192.168.192.35/60475 to outside131:10.131.16.4/60475'] } }
filter {
grok { match => { "message" => "%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}: %ASA-6-305011: %{CISCO_ACTION:action} %{CISCO_XLATE_TYPE:xlate_type} %{WORD:protocol} translation from %{DATA:src_interface}:%{IP:src_ip}(/%{INT:src_port}) to %{DATA:src_xlated_interface}:%{IP:src_xlated_ip}/%{DATA:src_xlated_port}" } }
}
output { stdout { codec => rubydebug { metadata => false } } }
```
---
### Author:  [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [June 19, 2019, 12:48am UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/5 "2019-06-19T00:48:51Z")
Thanks Badger,
I am trying to use the patterns file
>
but having a hard time getting it to play
Should I start with a catch all message of %{GREEDYDATA} or
`^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}`
Do you have an example logstash config that incorporates this setup?
I will keep trying to work this out
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 19, 2019, 1:25pm UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/6 "2019-06-19T13:25:01Z")
> [@VamPikmin](#):
>
> Do you have an example logstash config that incorporates this setup?
I do not.
---
### Author:  [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [June 20, 2019, 2:14am UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/7 "2019-06-20T02:14:44Z")
Thank you anyway. I am making some progress slowly
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2019, 2:14am UTC](https://discuss.elastic.co/t/cisco-asa-grok-parse-failure/186168/8 "2019-07-18T02:14:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.