Cisco_reason pattern not working

I am quite new to ELk , we are testing ELK V5.2 in out testing environment for Network syslog analytics . We face an issue while creating logstash conf that pattern "CISCO_RESON" is not been identifed even when its defined in patterns directory . Due to this all Cisco logs is getting grok parse failure . Its identifying CISCOTIMESTAMPTZ & SYSLOG5424PRI defined in same patterns directory .Please help on this ..

Grok
%{SYSLOG5424PRI}(%{NUMBER:log_sequence#})?:frowning: %{NUMBER}:)? %{CISCOTIMESTAMPTZ:log_date}: %%{CISCO_REASON:facility}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:message}
Pattern file
CISCOTIMESTAMPTZ %{CISCOTIMESTAMP}( %{TZ})?
NEXUSTIMESTAMP %{YEAR} %{MONTH} %{MONTHDAY} %{TIME}( %{TZ})?
CISCO_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s*)*

I have the same problem. Can you share the solution if you already find it please.

Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.