How do I grok this Cisco log?

Hi

Thank you for the earlier help, iam progressing in good way.

Iam going here is more granular logging and get more information for statistic purpose, at the same time i would like retain some message as it is for user to view.

Now i have 2 queries

Log messages :

Sep 19 03:53:51 DHCP-CA-DNS %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up

Grok Pattern :

%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:device_src} %{GREEDYDATA:syslog_message}

Output :

{
** "syslog_timestamp": "Sep 19 03:53:51",**
** "syslog_message": "%LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up",**
** "device_src": "DHCP-CA-DNS"**
}

all good so far.

When i go granular i am breaking my syslog_message. breaks in to different data as expected, that is good.

Log :

Sep 19 03:53:51 DHCP-CA-DNS %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up

Grok :
%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:device_src} %%{CISCO_REASON:facility}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:syslog_message}

Output :
{
** "syslog_timestamp": "Sep 19 03:53:51",**
** "severity_level": "5",**
** "syslog_message": "Line protocol on Interface Ethernet0/0, changed state to up",**
** "facility": "LINEPROTO",**
** "facility_mnemonic": "UPDOWN",**
** "device_src": "DHCP-CA-DNS"**
}

but iam looking as below :

{
"syslog_timestamp": "Sep 19 03:53:51",
"severity_level": "5",
"syslog_message1": "Line protocol on Interface Ethernet0/0, changed state to up",
"facility": "LINEPROTO",
"facility_mnemonic": "UPDOWN",
"device_src": "DHCP-CA-DNS"
"syslog_message" : %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up"
}

How can i achieve this ?

appreciate your help.

any help here...

Do you have 2 grok filters? I ask because I don't know where/why you get syslog_message and a syslog_message1 fields.

Use one grok filter and try anchoring the grok pattern to the start-of-string.

^%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:device_src} %%{CISCO_REASON:facility}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:syslog_message}

Thank for the reply, no i have only 1 grok filter, the output iam looking what i want to achieve,

can you give example how i can "Use one grok filter and try anchoring the grok pattern to the start-of-string."

In return for the example please edit the title of this discussion to make it easier for other to find the example below. "How do I grok this Cisco <device name here> log?"

Config example:

input {
  generator {
    message => 'Sep 19 03:53:51 DHCP-CA-DNS %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up'
    count => 1
  }
}

filter {
  grok {
    match => {
      "message" => [
        '^%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:device_src} %%{CISCO_REASON:facility}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:syslog_message}'
      ]
    }
  }
}

output {
  stdout { codec => rubydebug }
}

Result:

{
             "facility" => "LINEPROTO",
                 "host" => "Elastics-MacBook-Pro.local",
     "syslog_timestamp" => "Sep 19 03:53:51",
             "@version" => "1",
           "@timestamp" => 2018-09-26T08:31:21.756Z,
           "device_src" => "DHCP-CA-DNS",
             "sequence" => 0,
       "syslog_message" => "Line protocol on Interface Ethernet0/0, changed state to up",
              "message" => "Sep 19 03:53:51 DHCP-CA-DNS %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up",
       "severity_level" => "5",
    "facility_mnemonic" => "UPDOWN"
}

Thank you let me try and get back to you.

may be i gave some information wrong, in the grok, i have 3 or 4 match patterns, is this still works ?

Yes, multiple patterns are OK, have a look at the break_on_match setting in the docs.

break_on_match setting - if i understand correctly, once it matches then it will not proceed to next match and send the output to ES.

correct me if iam wrong please.

Correct

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.