# Help with GROK pattern - Cisco ASA CX
**URL:** https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126
**Category:** Logstash
**Created:** [May 16, 2016, 1:59pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126 "2016-05-16T13:59:04Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Mark\_Collins](https://discuss.elastic.co/u/Mark_Collins)
#### Post date: [May 16, 2016, 1:59pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/1 "2016-05-16T13:59:04Z")
Hi All
I have a new ELK installation and all is going well, have a couple of windows servers and firewall sending logs. Once I had told the installation to use more RAM all is running really good.
Trying to send logs from our Cisco CX web filtering but believe I need to create a new grok pattern as currently getting grokparsefailure
the log file that is being produced is below
\<142\>1 2016-05-16T13:54:30.578Z asacx-2 CiscoNGFW 20135 6 [ngfwEvent@9 Flow\_Dst\_Service="tcp/80" Flow\_Bytes\_Sent="196" Event\_Type="0" Flow\_DstIp="92.123.140.146" Flow\_SrcIp="192.168.120.40" Count="1" Url\_Category\_Name="Software Updates" Flow\_Bytes="196" Web\_Reputation\_Threat\_Type="" Avc\_Tag\_Name="" Ev\_SrcLabel="ASA CX" Event\_Type\_Name="HTTP Deny" Auth\_Realm\_Name="Adrian Flux Realm" User\_Realm="Adrian Flux Realm\Eilidh Alexander" Policy\_Name="Deny Internet Access" Flow\_Transaction\_Id="0" Url="[http://armdl.adobe.com/pub/adobe/reader/win/11.x/11.0.16/misc/AdbeRdrUpd11016.msp](http://armdl.adobe.com/pub/adobe/reader/win/11.x/11.0.16/misc/AdbeRdrUpd11016.msp)" Identity\_Source\_Name="AD Agent" Auth\_Policy\_Name="Default" Flow\_SrcIfc="inside" Flow\_ConnId="245191611" Identity\_Type\_Name="Passive" Flow\_DstHostName="[armdl.adobe.com](http://armdl.adobe.com)" Flow\_Transaction\_Count="1" Ev\_Id="80756764" AAA\_User="Eilidh Alexander" Web\_Reputation\_Score="4.1" Event\_Type\_Action="Deny" Ev\_GenTime="1463406782823" Flow\_DstPort="80" Flow\_DstIfc="outside" Ev\_SrcId="24" Avc\_App\_Name="HyperText Transfer Protocol" Ev\_SrcHwType="ASA-CX" Flow\_SrcPort="51463" Smx\_Config\_Version="544" Flow\_Requests\_Denied="1" Avc\_App\_Type="Infrastructure" Connection\_Dst\_Service="" Flow\_Protocol="tcp" Ev\_Producer\_Name="HTTP Inspector"]
I would like to grok this so we can have all the headings as fields in kibana, eg user\_realm, Flow\_dstport
Believe I need to do something with the filter grok {
match =\> ["message", ..................]
}
Thanks in advance
Mark
---
### Author:  [@Zibby](https://discuss.elastic.co/u/Zibby)
#### Post date: [May 16, 2016, 2:38pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/2 "2016-05-16T14:38:38Z")
I found [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) and [Test grok patterns](http://grokconstructor.appspot.com/do/match) very useful when writing my GROK filters.
There is a lot of info there, so I'd make use of match =\> ["message" , "%{GREEDYDATA:message}"] then try and filter out the useful bits.
I've made a start here for an example of how I start to construct these:
> \<142\>1 %{TIMESTAMP\_ISO8601:time}Z%{GREEDYDATA:data} [ngfwEvent@%{GREEDYDATA:more\_stuff\_to\_filter}
---
### Author:  [@Mark\_Collins](https://discuss.elastic.co/u/Mark_Collins)
#### Post date: [May 16, 2016, 2:58pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/3 "2016-05-16T14:58:38Z")
Thanks for this, sorry but complete newbie to this.
In my config file for the logs would I need to do match =\> ["message", \<142\>1 %{TIMESTAMP\_ISO8601:time}Z%{GREEDYDATA:data} [ngfwEvent@%{GREEDYDATA:more\_stuff\_to\_filter}]
I understand I need to split up the logfile, its just the how do I do that
Thanks
---
### Author:  [@Harley\_Burton](https://discuss.elastic.co/u/Harley_Burton)
#### Post date: [May 17, 2016, 12:16am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/4 "2016-05-17T00:16:11Z")
You would want to use grokdebug to get the fields pulled out the way you want, and then exactly as you think.
match =\> ["message", "%{blah}%{blah}]
I haven't messed with logs from the ASAx models, but my experience with the ASA has been that the messages are not completely uniform, as with a lot of systems, so you will likely need to have multiple grok patterns tried. They will attempt to match from the top down until they get a successful match, so you want to put your most specific ones at the top, and have a catchall that should match any message that doesn't get matched with a more specific one. You can change the config (logstash) so that it doesn't stop after a successful match, but that sounds like a horrible idea.
So you want...
```
match => [
"message", "%{most} %{specific} %{and/or} %{most} %{common}",
"message", "%{less}",
"message", "%{catch} %{all}"
]
overwrite => ["message"]
```
Roughly, a catchall may be something like
```
%{SYSLOG5424PRI}%{INT:whatever_this_is} %{TIMESTAMP_ISO8601:time} %{GREEDYDATA:message}
```
EDIT:
I forgot to mention to keep looking for a tag value \_grokparsefailure to see any messages that aren't being matched.
another tip for your example is create something to match all those blah=blah fields.
something like
```
asaXfield %{DATA:field}="%{DATA:value}"
```
Then you can use them is others like
```
%{SYSLOG5424PRI}%{INT:something} %{TIMESTAMP_ISO8601:time} %{DATA:something1} %{DATA:something2} %{INT:something3} %{INT:something4} \[%{DATA:something5} %{asaXfield}
```
I couldn't find any great documentation on the patterns themselves. Basically regex. However, you can look at the ones that are included and get an idea how it works.
>
---
### Author:  [@Mark\_Collins](https://discuss.elastic.co/u/Mark_Collins)
#### Post date: [May 17, 2016, 3:05pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/5 "2016-05-17T15:05:24Z")
Thanks for the information given, I have been able to create a pattern using the grok debugger
however when trying the enter this into logstash config it is erroring when doing the %{DATA:field}="%{DATA:something}" as I think the filter sees the " as the end of the line.
config line so far, that doesn't work
match =\> ["message", "%{SYSLOG5424PRI}%{INT:logtype} %{TIMESTAMP\_ISO8601} %{HOSTNAME} CiscoNGFW %{INT:lognumber} %{NOTSPACE} %{DATA:field}="%{DATA:Flow\_Dst\_Service}" %{GREEDYDATA:cxmessage}"]
config line that works
match =\> ["message", "%{SYSLOG5424PRI}%{INT:logtype} %{TIMESTAMP\_ISO8601} %{HOSTNAME} CiscoNGFW %{INT:lognumber} %{NOTSPACE} %{GREEDYDATA:cxmessage}"]
How do I add the %{DATA:field}="%{DATA:Flow\_Dst\_Service}" part into the config
Thanks again
Mark
---
### Author:  [@Harley\_Burton](https://discuss.elastic.co/u/Harley_Burton)
#### Post date: [May 22, 2016, 2:27pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/6 "2016-05-22T14:27:16Z")
I'm not where I can confirm it, but I'm pretty sure you can escape those out.
```
match => ["message", "%{SYSLOG5424PRI}%{INT:logtype} %{TIMESTAMP_ISO8601} %{HOSTNAME} CiscoNGFW %{INT:lognumber} %{NOTSPACE} %{DATA:field}=\"%{DATA:Flow_Dst_Service}\" %{GREEDYDATA:cxmessage}"
```
Note the " where you want a literal " in your pattern.
---
### Author:  [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)
#### Post date: [June 30, 2016, 11:07am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/7 "2016-06-30T11:07:42Z")
> [@Mark\_Collins](#):
>
> to send logs from our Cisco CX web filtering but believe I need to create a new grok pattern as currently getting grokparsefailure
>
> the log file that is being produced is belo
Someone in this forum adviced me to use kv plugin.
It's more easy to use 🙂
kv {
allow\_duplicate\_values =\> false
}
---
### Author:  [@Mark\_Collins](https://discuss.elastic.co/u/Mark_Collins)
#### Post date: [June 30, 2016, 2:40pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/8 "2016-06-30T14:40:22Z")
Hi Alex\_Lum
You absolute legend.
That has worked perfectly. I have had to to do a match filter to strip out some unwanted info then do the kv filter on the remaining message.
So happy can now get on building dashboard management want
Thanks again
Mark
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-cisco-asa-cx/50126/9 "2017-07-06T04:50:08Z")