# Cisco\_reason pattern not working
**URL:** https://discuss.elastic.co/t/cisco-reason-pattern-not-working/95366
**Category:** Logstash
**Created:** [August 1, 2017, 2:59pm UTC](https://discuss.elastic.co/t/cisco-reason-pattern-not-working/95366 "2017-08-01T14:59:37Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sreejiths](https://discuss.elastic.co/u/sreejiths)
#### Post date: [August 1, 2017, 2:59pm UTC](https://discuss.elastic.co/t/cisco-reason-pattern-not-working/95366/1 "2017-08-01T14:59:37Z")
I am quite new to ELk , we are testing ELK V5.2 in out testing environment for Network syslog analytics . We face an issue while creating logstash conf that pattern "CISCO\_RESON" is not been identifed even when its defined in patterns directory . Due to this all Cisco logs is getting grok parse failure . Its identifying CISCOTIMESTAMPTZ & SYSLOG5424PRI defined in same patterns directory .Please help on this ..
Grok
%{SYSLOG5424PRI}(%{NUMBER:log\_sequence#})?☹ %{NUMBER}:)? %{CISCOTIMESTAMPTZ:log\_date}: %%{CISCO\_REASON:facility}-%{INT:severity\_level}-%{CISCO\_REASON:facility\_mnemonic}: %{GREEDYDATA:message}
Pattern file
CISCOTIMESTAMPTZ %{CISCOTIMESTAMP}( %{TZ})?
NEXUSTIMESTAMP %{YEAR} %{MONTH} %{MONTHDAY} %{TIME}( %{TZ})?
CISCO\_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s\*)\*
---
### Author:  [@Benoit\_Martin](https://discuss.elastic.co/u/Benoit_Martin)
#### Post date: [August 17, 2017, 8:44pm UTC](https://discuss.elastic.co/t/cisco-reason-pattern-not-working/95366/2 "2017-08-17T20:44:59Z")
I have the same problem. Can you share the solution if you already find it please.
Thank you!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2017, 8:45pm UTC](https://discuss.elastic.co/t/cisco-reason-pattern-not-working/95366/3 "2017-09-14T20:45:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.