# Cisco ASA parse failure

**URL:** <https://discuss.elastic.co/t/cisco-asa-parse-failure/224259>\
**Category:** Logstash\
**Created:** [March 19, 2020, 11:31am UTC](https://discuss.elastic.co/t/cisco-asa-parse-failure/224259 "2020-03-19T11:31:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sai\_kiran1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_kiran1/32/44118_2.png) [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\
**Post date:** [March 19, 2020, 11:31am UTC](https://discuss.elastic.co/t/cisco-asa-parse-failure/224259/1 "2020-03-19T11:31:24Z")

</div>

Hello,

I get below error when trying to parse cisco messages.

```
[2020-03-19T12:21:34,554][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<Grok::PatternError: pattern %{CISCOFW113004} not defined>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:123:in `block in compile'", "org/jruby/RubyKernel.java:1425:in `loop'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:93:in `compile'", "/usr/share/logstash/vendor/local_gems/fb326bcf/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:288:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/local_gems/fb326bcf/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:282:in `block in register'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/vendor/local_gems/fb326bcf/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:277:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:56:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:612:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:280:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x5d476374 run>"}

```

Any suggestions for how this can be addressed?

Regards,  
Sai

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2020, 4:21pm UTC](https://discuss.elastic.co/t/cisco-asa-parse-failure/224259/2 "2020-03-22T16:21:09Z")

</div>

> [@sai\_kiran1](#):
>
> Grok::PatternError: pattern %{CISCOFW113004} not defined

Where have you defined that pattern?

---

<div class="post-metadata">

**Author:** ![sai\_kiran1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_kiran1/32/44118_2.png) [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\
**Post date:** [March 22, 2020, 4:39pm UTC](https://discuss.elastic.co/t/cisco-asa-parse-failure/224259/3 "2020-03-22T16:39:31Z")

</div>

Nevermind, not all patterns for cisco firewall logs are available in logstash-patterns-core [https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/firewalls](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/firewalls) . Written custom patterns for my cyslog asa logs.

Thank you....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2020, 4:39pm UTC](https://discuss.elastic.co/t/cisco-asa-parse-failure/224259/4 "2020-04-19T16:39:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.