Thanks Badger,
I am trying to use the patterns file
but having a hard time getting it to play
Should I start with a catch all message of %{GREEDYDATA} or
^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}
Do you have an example logstash config that incorporates this setup?
I will keep trying to work this out