Cisco_reason pattern not working

Elastic Stack Logstash
1

I am quite new to ELk , we are testing ELK V5.2 in out testing environment for Network syslog analytics . We face an issue while creating logstash conf that pattern "CISCO_RESON" is not been identifed even when its defined in patterns directory . Due to this all Cisco logs is getting grok parse failure . Its identifying CISCOTIMESTAMPTZ & SYSLOG5424PRI defined in same patterns directory .Please help on this ..

Grok
%{SYSLOG5424PRI}(%{NUMBER:log_sequence#})?:frowning: %{NUMBER}:)? %{CISCOTIMESTAMPTZ:log_date}: %%{CISCO_REASON:facility}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:message}
Pattern file
CISCOTIMESTAMPTZ %{CISCOTIMESTAMP}( %{TZ})?
NEXUSTIMESTAMP %{YEAR} %{MONTH} %{MONTHDAY} %{TIME}( %{TZ})?
CISCO_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s*)*

2

I have the same problem. Can you share the solution if you already find it please.

Thank you!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.