# Cisco Log

**URL:** <https://discuss.elastic.co/t/cisco-log/80280>\
**Category:** Logstash\
**Created:** [March 28, 2017, 10:57am UTC](https://discuss.elastic.co/t/cisco-log/80280 "2017-03-28T10:57:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\
**Post date:** [March 28, 2017, 10:57am UTC](https://discuss.elastic.co/t/cisco-log/80280/1 "2017-03-28T10:57:08Z")

</div>

hi i have been trying for quite some time but i cannot get it to work .... here is my config ..

file \>\>\>\>\>\>\>\> 02-beat-input.conf  
input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
udp {  
port =\> 5140  
type =\> "syslog"  
}

}  
file \>\>\>\>\>\>\>\>\>\>\>\>\>03-cisco-filter.conf

filter {  
grok {  
match =\> { "message" =\> "%{CISCOFW710001\_710002\_710003\_710005\_710006 %{WORD:protocol} (?:request|access) %{CISCO\_ACTION:action} from %{IP:src\_ip}/%{INT:src\_port} to %{DATA:dst\_interface}:%{IP:dst\_ip}/%{INT:dst\_port}" }  
}  
}  
# Parse the syslog severity and facility  
syslog\_pri { }  
dns {  
reverse =\> ["host"]  
action =\> "replace"  
}  
geoip {  
source =\> "src\_ip"  
target =\> "geoip"  
database =\> "/opt/logstash/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}  
# do GeoIP lookup for the ASN/ISP information.  
geoip {  
database =\> "/opt/logstash/GeoIPASNum.dat"  
source =\> "src\_ip"  
}  
}  
~  
file \>\>\>\>\>\>\>\>\>\>\>\>\>\>10-syslog-filter.conf  
filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}

}  
file \>\>\>\>\>\>\>\>\>\>\>\>\>\> 30-elasticsearch-output.conf

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]

# sniffing =\> true

# manage\_template =\> false

# index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"

# document\_type =\> "%{[@metadata][type]}"

}  
stdout {  
codec =\> rubydebug  
}

}  
.... i have been trying al sort of thing for quite some time but could not make it to work ...  
I have several Cisco Devices which i want to send its log to this elk but i can't . i have this on my kibana which shows log is being shipped but i cant analyse base on source ip, port etc etc ...  
message:\<

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2017, 1:13am UTC](https://discuss.elastic.co/t/cisco-log/80280/2 "2017-03-30T01:13:44Z")

</div>

What's not working exactly?

---

<div class="post-metadata">

**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\
**Post date:** [March 30, 2017, 3:53am UTC](https://discuss.elastic.co/t/cisco-log/80280/3 "2017-03-30T03:53:03Z")

</div>

Thanks Goodness Mark ...  
i cannot see the log message is correctly parse i guess therefore analysed ...

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2017, 4:26am UTC](https://discuss.elastic.co/t/cisco-log/80280/4 "2017-03-30T04:26:28Z")

</div>

Where are you looking at this log message? Is it in stdout, in ES?

---

<div class="post-metadata">

**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\
**Post date:** [March 30, 2017, 6:51am UTC](https://discuss.elastic.co/t/cisco-log/80280/5 "2017-03-30T06:51:39Z")

</div>

?yes

---

<div class="post-metadata">

**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\
**Post date:** [April 3, 2017, 10:17am UTC](https://discuss.elastic.co/t/cisco-log/80280/6 "2017-04-03T10:17:16Z")

</div>

can anyone help my with my issue ???

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2017, 10:17am UTC](https://discuss.elastic.co/t/cisco-log/80280/7 "2017-05-01T10:17:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.