### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 24, 2017, 9:42am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/1 "2017-03-24T09:42:14Z")
Anyone with working Logstash Working config for processinf Cisco Logs
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 24, 2017, 9:57am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/2 "2017-03-24T09:57:13Z")
Logstash ships with a bunch of grok patterns for various kind of Cisco logs:
>
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 24, 2017, 10:00am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/3 "2017-03-24T10:00:35Z")
thanks ... would you mind give a working config
thanks in advance
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 25, 2017, 8:47am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/4 "2017-03-25T08:47:29Z")
input {
udp {
port =\> 514 ## change me to whatever you set your ASA syslog port to
type =\> "syslog"
}
}
filter {
####### Cisco FW ####
if [type] == "syslog" {
grok {
match =\> ["message", "%{CISCO\_TAGGED\_SYSLOG} %{GREEDYDATA:cisco\_message}"]
}
# Parse the syslog severity and facility
syslog\_pri { }
# Extract fields from the each of the detailed message types
# The patterns provided below are included in core of LogStash 1.2.0.
grok {
match =\> [
"cisco\_message", "%{CISCOFW106001}",
"cisco\_message", "%{CISCOFW106006\_106007\_106010}",
"cisco\_message", "%{CISCOFW106014}",
"cisco\_message", "%{CISCOFW106015}",
"cisco\_message", "%{CISCOFW106021}",
"cisco\_message", "%{CISCOFW106023}",
"cisco\_message", "%{CISCOFW106100}",
"cisco\_message", "%{CISCOFW110002}"
thisis my tey but still not work can you propose any error i make or give any working config ....
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 25, 2017, 8:48am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/5 "2017-03-25T08:48:19Z")
my router is not a asa fw it is a normal router with syslog message
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 26, 2017, 7:44am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/6 "2017-03-26T07:44:56Z")
magnus
can you share a working config for cisco ....
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 26, 2017, 8:51am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/7 "2017-03-26T08:51:51Z")
which beat should i make default, is it packetbeat or filebeat ???
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 26, 2017, 9:02am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/8 "2017-03-26T09:02:53Z")
input {
# beats {
# port =\> 5044
# ssl =\> true
# ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"
# ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"
# }
udp {
port =\> 514
type =\> "cisco-fw"
}
}
filter {
```
# Extract fields from the each of the detailed message types
# The patterns provided below are included in core of LogStash 1.4.2.
grok {
match => [
"message", "%{CISCOFW106001}",
"message", "%{CISCOFW106006_106007_106010}",
"message", "%{CISCOFW106014}",
"message", "%{CISCOFW106015}",
"message", "%{CISCOFW106021}",
"message", "%{CISCOFW106023}",
"message", "%{CISCOFW106100}",
"message", "%{CISCOFW110002}",
"message", "%{CISCOFW302010}",
"message", "%{CISCOFW302013_302014_302015_302016}",
"message", "%{CISCOFW302020_302021}",
"message", "%{CISCOFW305011}",
"message", "%{CISCOFW313001_313004_313008}",
"message", "%{CISCOFW313005}",
"message", "%{CISCOFW402117}",
"message", "%{CISCOFW402119}",
"message", "%{CISCOFW419001}",
"message", "%{CISCOFW419002}",
"message", "%{CISCOFW500004}",
"message", "%{CISCOFW602303_602304}",
"message", "%{CISCOFW710001_710002_710003_710005_710006}",
"message", "%{CISCOFW713172}",
"message", "%{CISCOFW733100}"
]
}
# Parse the syslog severity and facility
syslog_pri { }
```
# Do a DNS lookup for the sending host
# Otherwise host field will contain an
# IP address instead of a hostname
dns {
reverse =\> ["host"]
action =\> "replace"
}
geoip {
source =\> "src\_ip"
target =\> "geoip"
database =\> "/opt/logstash/GeoLiteCity.dat"
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert =\> ["[geoip][coordinates]", "float"]
}
# do GeoIP lookup for the ASN/ISP information.
geoip {
database =\> "/opt/logstash/GeoIPASNum.dat"
source =\> "src\_ip"
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
sniffing =\> true
manage\_template =\> false
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
....Also i can see cisco router log ciming to udp port 514 but no index etc etc ....
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 27, 2017, 1:31am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/9 "2017-03-27T01:31:48Z")
Hi Magnus
Can you reply to my last comment with config attach.
Thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2017, 5:04am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/10 "2017-03-27T05:04:00Z")
> thisis my tey but still not work can you propose any error i make or give any working config ....
How can we possibly help when we don't know what the messages that you get from your router looks like?
> which beat should i make default, is it packetbeat or filebeat ???
Neither Packetbeat or Filebeat deals with syslog messages so I'm not sure why you'd need either.
> ....Also i can see cisco router log ciming to udp port 514 but no index etc etc ....
How did you verify that no indexes are created?
For now I suggest you comment out the `index` and `document_type` options in your elasticsearch output. Right now you'll be fine with the default settings.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 27, 2017, 7:53am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/11 "2017-03-27T07:53:49Z")
there is no elasticsearch output .... logs are send direct to logstash which on the same host as elasticsearch
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2017, 7:55am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/12 "2017-03-27T07:55:51Z")
> there is no elasticsearch output
Yes, that's what you said but how did you reach that conclusion?
Temporarily replace the elasticsearch output with a `stdout { codec => rubydebug }` to remove one source of errors yet still see exactly what the resulting events look like.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 27, 2017, 8:16am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/13 "2017-03-27T08:16:01Z")
> [@magnusbaeck](#):
>
> stdout { codec =\> rubydebug }
like this
output {
stdout { codec =\> rubydebug }
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2017, 8:17am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/14 "2017-03-27T08:17:19Z")
Yes.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 27, 2017, 8:19am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/15 "2017-03-27T08:19:07Z")
this is the log message coming to elk
Mar 27 21:17:01 ciscorouterip 32710588: ha-ir1: Mar 27 21:17:01: %FMANFP-6-IPACCESSLOGP: SIP0: fman\_fp\_image: list OUTGOING-FILTER permitted tcp sourceip(26056) Port-channel20.20-\> destinationip(443), 1 packet
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 27, 2017, 8:25am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/16 "2017-03-27T08:25:14Z")
whats the setting for index pattern on kibana ???
also where i can see index created
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2017, 8:27am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/17 "2017-03-27T08:27:57Z")
> whats the setting for index pattern on kibana ???
> **[Index patterns has been renamed to data views. | Kibana Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/kibana/current/index-patterns.html)**
> also where i can see index created
You can use Elasticsearch's "cat indices" API.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 27, 2017, 8:37am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/18 "2017-03-27T08:37:24Z")
comeon mate i know how to create and delete index. What i am asking for cos all these changes it has no effect whatsoever.
FYI
i have another elk stack which is perfectly work with packetbeat shipped log from my 4 DNS resolver to that elk. So i could not find a way to make it work so that some server with logfiles using filebeat to shipped its log to that same elk, i setup this elk server so filebeat can shipped log from my smtp, pop3, radius, syslog server for cisco routers, bras, mpls PE routers etc etc ....
i have search and search for about a week or two now and you seems to just point me to that basic tutorial of creating index and deleting index which is not help at all ...
i understabd your point much like the chinese proverb. If i ask you a fish today you give me one i can eat fish for one day , but if you teach me how to fish i can eat fish all day ... to mke it short it is quite frustrating for keep asking all these ... anyway i think it is taking your time but i just ask you for some workign config thats all , but you seems not want to do that instead you just beat wrounf the bush ,,,, anyway i hope you would be more helpful ...
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2017, 8:53am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/19 "2017-03-27T08:53:34Z")
> i have search and search for about a week or two now and you seems to just point me to that basic tutorial of creating index and deleting index which is not help at all ...
I don't know when I ever pointed you to documentation describing how to create and delete indexes. I did point you to documentation about index patterns in Kibana which is what I thought you asked for.
> to mke it short it is quite frustrating for keep asking all these ... anyway i think it is taking your time but i just ask you for some workign config thats all , but you seems not want to do that instead you just beat wrounf the bush ,,,, anyway i hope you would be more helpful ...
If it were easy to give you a working configuration that's what I'd do. Since your immediate problem seems to be in getting any kind of data into ES even though you have a reasonable-looking configuration file there's nothing I can do but attempt to debug the problem, and because I don't have access to your machine asking you questions is the only thing I can do.
Debating how I choose to offer my help isn't productive for any of us. Good luck.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [March 27, 2017, 9:00am UTC](https://discuss.elastic.co/t/cisco-log-processing/79870/20 "2017-03-27T09:00:05Z")
apologise for my frustration on trying to figure this out. i know you make time reply to my message and i should appreciate that ,,, anyway thanks for your time i will keep looking aroung the www for any thing that might solve my problem. I promise if i will success doing it i will put all the config (input,filter,and output) here so that someone in the future would benefit from. anyway sorry for my tone but i really hope this would work sooner but it seems i will keep looking hopefully another week or two as my goal ... anyway thanks for your time an effort,
Regards
Maile.
[Next page](https://discuss.elastic.co/t/cisco-log-processing/79870.md?page=2)