Cisco IOS Filebeat Indexing Error

andrewkroh · November 12, 2020, 9:19pm

That format looks a little different that what it was expecting when reading from a log file. Yours has the original syslog pri and some additional number at the start. This is what it expects.

github.com

elastic/beats/blob/425271b6553604698f1b08c934ab5ddaf308636b/x-pack/filebeat/module/cisco/ios/config/pipeline.js#L88


var copyOriginalMessage = new processor.Convert({
    fields: [
        {from: "message", to: "log.original"},
    ],
    mode: "copy",
});
var parseSyslogFileHeader = new processor.Chain()
    .Dissect({
        tokenizer: "%{_tmp.ts->} %{+_tmp.ts} %{+_tmp.ts->} %{log.source.address} %{event.sequence}: %{_tmp.timestamp}: %{_tmp.message}",
        field: "message",
        target_prefix: "",
    })
    .Convert({
        fields: [
            {from: "_tmp.message", to: "message"},
        ],
        mode: "rename",
    })
    .Convert({

The good news is that you can edit that dissect pattern in your Filebeat install and it should work.

I think the right tokenizer for the format your logs are in would be

tokenizer: "<%{_tmp.pri}>%{event.sequence}: *%{_tmp.timestamp->} %{+_tmp.timestamp} %{+_tmp.timestamp->}: %{_tmp.message}"

Topic		Replies	Views
Cisco module IOS error on parsing logs Beats filebeat	1	269	September 29, 2022
Cisco Module arbitrary parse error with nearly identical messages Beats beats-module , filebeat	3	698	February 11, 2020
Filebeat Cisco IOS problem Beats filebeat	2	843	December 9, 2020
Parse error for cisco asa logs in filebeat module Beats filebeat	2	735	August 15, 2019
FileBeat Not Processing Cisco 2960X Logs Beats filebeat	1	302	October 7, 2021

Cisco IOS Filebeat Indexing Error

Related topics