# Logstah filter for cisco device
**URL:** https://discuss.elastic.co/t/logstah-filter-for-cisco-device/96606
**Category:** Logstash
**Created:** [August 10, 2017, 12:07pm UTC](https://discuss.elastic.co/t/logstah-filter-for-cisco-device/96606 "2017-08-10T12:07:47Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@muratungor](https://discuss.elastic.co/u/muratungor)
#### Post date: [August 10, 2017, 12:07pm UTC](https://discuss.elastic.co/t/logstah-filter-for-cisco-device/96606/1 "2017-08-10T12:07:47Z")
Hello
we have syslog-ng server that collects logs from cisco switches, routers etc. and syslog-ng writes that logs to its filesistem. here is an example of lines from cisco
Aug 10 14:56:30 ip..ip.ip.ip hostname: Aug 10 14:56:30.072 TSI: %SPANTREE-7-PORTDEL\_SUCCESS: GigabitEthernet1/0/2 deleted from Vlan 851
Aug 10 14:56:30 ip.ip.ip.ip hostname: Aug 10 14:56:29.235 TSI: %EPM-6-IPEVENT: IP 0.0.0.0| MAC 001a.e80d.8a2d| AuditSessionID 0A6DC015000085F6E8E98B24| EVENT IP-RELEASE
when i sent this log from syslog-ng to logstash with below filter it seems like this
input {
tcp {
host =\> "10.104.185.158"
port =\> 5515
type =\> "networklogs\_cisco"
}
}
filter{
if [type] == "networklogs\_ciso" {
grok {
break\_on\_match =\> true
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{INT:port} %{INT:version} %{SYSLOGHOST:syslog\_hostname} %{SYSLOGTIMESTAMP:origin\_timestamp} %{SYSLOGHOST:syslog\_ip} %{SYSLOGHOST:origin\_hostname}: %{CISCOTIMESTAMP:cisco\_timestamp} TSI: %%{CISCO\_REASON:facility}-%{CISCO\_REASON:facility\_sub}-%{INT:severity\_level}-%{CISCO\_REASON:facility\_mnemonic}: %{GREEDYDATA:message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{origin\_hostname}"]
remove\_field =\> ["syslog\_timestamp", "port", "version", "syslog\_hostname"]
```
}
date {
match => ["origin_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
```
}
output {
if [type] == "networklogs\_cisco" {
file {
path =\> "/var/log/logstash/networklogs\_cisco"
}
```
}
```
}
[root@hostname~]# tail -f /var/log/logstash/networklogs\_cisco
{"@timestamp":"2017-08-10T11:59:26.431Z","port":42085,"@version":"1","host":"syslogng's ip","message":"\<190\>Aug 10 14:59:26 10.109.0.14 hq-809s: Aug 10 14:59:26.019 TSI: %EPM-6-IPEVENT: IP ip.ip.ip.ip| MAC 001a.e826.9039| AuditSessionID 0A6D000E00005B0CDCD7D2F8| EVENT IP-ASSIGN","type":"networklogs\_cisco"}
what i expect is, I dont want to see timestamp, port, version, syslogng ip. Becouse when i sent this log to elastic I could not see the right fields on kibana
I only want to see the fields on kibana is
%{SYSLOGTIMESTAMP:origin\_timestamp} %{SYSLOGHOST:syslog\_ip} %{SYSLOGHOST:origin\_hostname}: %{CISCOTIMESTAMP:cisco\_timestamp} TSI: %%{CISCO\_REASON:facility}-%{CISCO\_REASON:facility\_sub}-%{INT:severity\_level}-%{CISCO\_REASON:facility\_mnemonic}: %{GREEDYDATA:message}" }
best regards
Murat
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2017, 12:08pm UTC](https://discuss.elastic.co/t/logstah-filter-for-cisco-device/96606/2 "2017-09-07T12:08:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.