# Groking of cisco switch logs (non asa)
**URL:** https://discuss.elastic.co/t/groking-of-cisco-switch-logs-non-asa/119485
**Category:** Logstash
**Created:** [February 12, 2018, 2:44pm UTC](https://discuss.elastic.co/t/groking-of-cisco-switch-logs-non-asa/119485 "2018-02-12T14:44:06Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ssi](https://discuss.elastic.co/u/ssi)
#### Post date: [February 12, 2018, 2:44pm UTC](https://discuss.elastic.co/t/groking-of-cisco-switch-logs-non-asa/119485/1 "2018-02-12T14:44:06Z")
Hi just wanted to give something back to the community here is the grok and pattern file that i got things working with. if there are a shorter/better way to do this please feel free to amend the post.
I thought this was going to be simple but cicso devises will send different syslog format from the same device it seems.
pattern file
CISCOTIMESTAMPTZ %{CISCOTIMESTAMP}( %{TZ})?
NEXUSTIMESTAMP %{YEAR} %{MONTH} %{MONTHDAY} %{TIME}( %{WORD:TIMEZONE})?
NETWORKTIMESTAMP %{MONTH} %{MONTHDAY} %{YEAR} %{TIME}?
logstash filter section
filter {
if [beat][name] == "network" {
# There are a couple of custom patterns associated with this filter.
grok {
patterns\_dir =\> ["e:/ELK/6.0.0/logstash/logstash-6.0.0/config/patterns/"]
break\_on\_match =\> true
# IOS
match =\>
[ "message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{NOTSPACE}%{SPACE}%{NEXUSTIMESTAMP:cisco\_host\_timestamp}:%{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{SYSLOGTIMESTAMP:cisco\_host\_timestamp}%{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{INT}: %{SPACE}%{NOTSPACE}%{SYSLOGTIMESTAMP:cisco\_host\_timestamp}%{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{INT}: %{INT}: %{SYSLOGTIMESTAMP:cisco\_host\_timestamp}%{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{INT}: %{INT}: %{SPACE}%{NOTSPACE}%{SYSLOGTIMESTAMP:cisco\_host\_timestamp}%{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{INT}: %{SYSLOGTIMESTAMP:cisco\_host\_timestamp}: %{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{SYSLOGTIMESTAMP:cisco\_host\_timestamp}%{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} : %{NEXUSTIMESTAMP:cisco\_host\_timestamp}: %{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{NETWORKTIMESTAMP:cisco\_host\_timestamp}:{GREEDYDATA:cisco\_message}",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{NETWORKTIMESTAMP:cisco\_host\_timestamp}: %{GREEDYDATA:cisco\_message} ",
"message", "%{SYSLOGTIMESTAMP:log\_server\_timestamp} %{IP:cisco\_host} %{INT}: %{GREEDYDATA:cisco\_message}" ]
remove\_field =\> ["beat.hostname","beat.version","@version","source", "TIMEZONE","message"]
}
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2018, 2:44pm UTC](https://discuss.elastic.co/t/groking-of-cisco-switch-logs-non-asa/119485/2 "2018-03-12T14:44:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.