Log Parsing

[mansa]

Actually we have two variety of logs.

1. Syslogs which comes from Linux device ( start with time)
2. Syslog but comes from cisco devices

Logs which comes from cisco device start with hostname and logs which comes from linux start with time so i want to send the logs which comes from cisco device to different port so how do i filter like if my logs start with hostname it should go to differnt port (other then configure for linux device)?

what if or else statment or any other way which pick if logs start with hostname then it should go port "6514"
Please advise.

[warkolm (Mark Walkom)]

Welcome to our community!

Logstash cannot redirect events until they have been received. You will need to tell your Cisco devices to send to a specific endpoint, and then configure your hosts to send to another.

[mansa]

Hello Dear

yes we are getting logs at logstash as per below
Format 1
Msg: Sep 15 18:14:49 Servername cupsd[1317]: REQUEST localhost - - "POST / HTTP/1.1" 200 184 Renew-Subscription successful-ok\0x0a

Format2
Msg: 73166:bsy-lup11-4938: Sep 16 17:42:27: %SYS-5-CONFIG_I: Configured from console by cyberark_admin on vty0 (XX.34.XX.240)

Now my requirement is that if logs start with host name it should go to the different port (foramat2) and log start with time stamp it should go to different port as output how do i do that ?

[warkolm (Mark Walkom)]

As output to where?

[mansa]

We are sending output to our one of they server (Mcafee receiver)
let say 10.x.x.x etc...we need to forward to it but for type 1 log should to go to port 514 or type 2 go to 6514 etc...so how to we configure this.

Note : our input is same ( end nodes are forwarding to logstash)

[Badger]

You could do something like

output {
    if [message] =~ /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/ {
        ...
    } else {
        ...
    }
}

to choose between two outputs.