# Cisco ASA Patterns in Logstash 1.5.1 **URL:** \ **Category:** Logstash\ **Created:** [June 30, 2015, 7:57pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661 "2015-06-30T19:57:21Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![DavidSims](https://avatars.discourse-cdn.com/v4/letter/d/8491ac/32.png) [@DavidSims](https://discuss.elastic.co/u/DavidSims)\ **Post date:** [June 30, 2015, 7:57pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/1 "2015-06-30T19:57:21Z")
I have yet to get logstash to parse Cisco ASA logs correctly. I have tried every tutorial a could find and I ALWAYS get \_grokparsefailure. I stripped it all the way down and it seems to hate the patterns. filter { grok { match =\> ["message", "%{CISCO\_TAGGED\_SYSLOG} %{GREEDYDATA:cisco\_message}"] } ``` # Extract fields from the each of the detailed message types # The patterns provided below are included in core of LogStash 1.4.2. grok { match => [ "cisco_message", "%{CISCOFW106001}", "cisco_message", "%{CISCOFW106006_106007_106010}", "cisco_message", "%{CISCOFW106014}", "cisco_message", "%{CISCOFW106015}", "cisco_message", "%{CISCOFW106021}", "cisco_message", "%{CISCOFW106023}", "cisco_message", "%{CISCOFW106100}", "cisco_message", "%{CISCOFW110002}", "cisco_message", "%{CISCOFW302010}", "cisco_message", "%{CISCOFW302013_302014_302015_302016}", "cisco_message", "%{CISCOFW302020_302021}", "cisco_message", "%{CISCOFW305011}", "cisco_message", "%{CISCOFW313001_313004_313008}", "cisco_message", "%{CISCOFW313005}", "cisco_message", "%{CISCOFW402117}", "cisco_message", "%{CISCOFW402119}", "cisco_message", "%{CISCOFW419001}", "cisco_message", "%{CISCOFW419002}", "cisco_message", "%{CISCOFW500004}", "cisco_message", "%{CISCOFW602303_602304}", "cisco_message", "%{CISCOFW710001_710002_710003_710005_710006}", "cisco_message", "%{CISCOFW713172}", "cisco_message", "%{CISCOFW733100}" ] } ``` } ---
**Author:** ![Don\_Click](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@Don\_Click](https://discuss.elastic.co/u/Don_Click)\ **Post date:** [October 14, 2015, 12:57pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/2 "2015-10-14T12:57:48Z")
did you ever get this sorted out? I have been struggling with this for a few weeks myself. all the examples we find are for previous versions, with half of the filters being deprecated. ---
**Author:** ![etfeet](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@etfeet](https://discuss.elastic.co/u/etfeet)\ **Post date:** [October 23, 2015, 5:20pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/3 "2015-10-23T17:20:00Z")
This is what I'm using for asa parsing: our asa logs like like: 2015-10-12T11:34:43-07:00 my-asa-ip %ASA-4-106023: Deny icmp src outside:x.x.x.x dst inside:x.x.x.x (type 8, code 0) by access-group "outside\_access\_in" [0xe7113be6, 0x0] We receive the syslog's from syslog-ng and output to a log file on the system. We then have logstash monitor the file with a file input: syslog-ng.conf: ``` options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); ts_format(iso); stats(0); }; source s_net_dev { udp(ip(0.0.0.0) port(2514) flags(no-hostname)); tcp(ip(0.0.0.0) port(2514) flags(no-hostname)); }; destination d_net_dev { file("/var/log/network.log" owner("root") group("root") perm(0644)); }; log { source(s_net_dev); destination(d_net_dev); }; ``` asa-filter.conf: ``` filter { if "fw-cisco" in [tags] { mutate { remove_field => ["host"] } grok { patterns_dir => "/etc/logstash/patterns.d/" match => ["message", "%{TIMESTAMP_ISO8601:timestamp} %{IP:host} %%{CISCOTAG:cisco_tag}: %{GREEDYDATA:cisco_message}"] } mutate { remove_field => ["message"] } mutate { gsub => ["cisco_message", '"', ""] } } #match cisco message patterns grok { patterns_dir => "/etc/logstash/patterns.d/" match => [ "cisco_message", "%{CISCOFW106001}", "cisco_message", "%{CISCOFW106006_106007_106010}", "cisco_message", "%{CISCOFW106014}", "cisco_message", "%{CISCOFW106015}", "cisco_message", "%{CISCOFW106021}", "cisco_message", "%{CISCOFW106023}", "cisco_message", "%{CISCOFW106100}", "cisco_message", "%{CISCOFW110002}", "cisco_message", "%{CISCOFW302010}", "cisco_message", "%{CISCOFW302013_302014_302015_302016}", "cisco_message", "%{CISCOFW302020_302021}", "cisco_message", "%{CISCOFW305011}", "cisco_message", "%{CISCOFW313001_313004_313008}", "cisco_message", "%{CISCOFW313005}", "cisco_message", "%{CISCOFW402117}", "cisco_message", "%{CISCOFW402119}", "cisco_message", "%{CISCOFW419001}", "cisco_message", "%{CISCOFW419002}", "cisco_message", "%{CISCOFW500004}", "cisco_message", "%{CISCOFW602303_602304}", "cisco_message", "%{CISCOFW710001_710002_710003_710005_710006}", "cisco_message", "%{CISCOFW713172}", "cisco_message", "%{CISCOFW733100}", "cisco_message", "Built local-host %{WORD}:%{IP}" ] } ... ``` grok patterns are here [http://pastebin.com/1bx5s5Gp](http://pastebin.com/1bx5s5Gp) ---
**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Post date:** [October 23, 2015, 5:37pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/4 "2015-10-23T17:37:59Z")
I've been struggling with this for a while also. At last I made work, and wrote an article to share it with the world: [http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/](http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/) Hope it helps you! ---
**Author:** ![DavidSims](https://avatars.discourse-cdn.com/v4/letter/d/8491ac/32.png) [@DavidSims](https://discuss.elastic.co/u/DavidSims)\ **Post date:** [October 23, 2015, 8:55pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/5 "2015-10-23T20:55:20Z")
It took 4 months but that was the answer!! I'm at the point where I don't even care what's different - I'm just thrilled it's working. ---
**Author:** ![navox19](https://avatars.discourse-cdn.com/v4/letter/n/49beb7/32.png) [@navox19](https://discuss.elastic.co/u/navox19)\ **Post date:** [April 15, 2016, 10:22pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/6 "2016-04-15T22:22:41Z")
can you share your config input and filter and output @DavidSims plz i'm lost here need help ---
**Author:** ![DavidSims](https://avatars.discourse-cdn.com/v4/letter/d/8491ac/32.png) [@DavidSims](https://discuss.elastic.co/u/DavidSims)\ **Post date:** [April 18, 2016, 7:03pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/7 "2016-04-18T19:03:43Z")
I followed [http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/](http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/) from above. There is nothing special about the input - but I start my filter with - filter { if [type] == "syslog" { if "%ASA-" in [message] { grok { copy and pasted the grok section} ---
**Author:** ![navox19](https://avatars.discourse-cdn.com/v4/letter/n/49beb7/32.png) [@navox19](https://discuss.elastic.co/u/navox19)\ **Post date:** [April 18, 2016, 7:21pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/8 "2016-04-18T19:21:56Z")
do you use one single config file ? because i have 3 config files 30-elasticsearch-output.conf output { elasticsearch { hosts =\> ["localhost:9200"] sniffing =\> true manage\_template =\> false index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } 10-syslog-filter.conf filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } 02-beats-input.conf input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } need litle help ---
**Author:** ![DavidSims](https://avatars.discourse-cdn.com/v4/letter/d/8491ac/32.png) [@DavidSims](https://discuss.elastic.co/u/DavidSims)\ **Post date:** [April 18, 2016, 7:35pm UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/9 "2016-04-18T19:35:40Z")
No, I have multiple. These three are related to the ASA logs. 01-inputs.conf 02-syslog.conf 99-outputs.conf There is nothing special in inputs or outputs. David ---
**Author:** ![KabeloShongwe](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@KabeloShongwe](https://discuss.elastic.co/u/KabeloShongwe)\ **Post date:** [June 13, 2016, 11:25am UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/10 "2016-06-13T11:25:22Z")
@DavidSims, truth is that you will get grok\_failures. There are thousands logs from cisco-asa. just log the grok\_failures somewhere were you can lookup for the important ones and add them to your patterns file using "patterns\_dir". ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/cisco-asa-patterns-in-logstash-1-5-1/24661/11 "2017-07-06T04:53:21Z")