Hello,
Brand new to ELK but I can't seem to find another log or method to try to narrow down what is happening in this case.
Both devices are configured to send log messages to 8514/tcp where logstash is listening. They are essentially the same message and a tcpdump confirms they arrive at the logstash host, however, one message makes it into elasticsearch, the other does not.
My logstash configs are as folows:
001-input.conf
input {
udp {
port => "8514"
type => "syslog-cisco"
}
tcp {
port => "8514"
type => "syslog-cisco"
}
}
010-cisco-sylog.conf
filter {
if [type] == "syslog-cisco" {
fingerprint {
source => [ "message" ]
method => "SHA1"
key => "4dITFMoHkxSXMqifRPf5sd8NZoPb7x7s"
concatenate_sources => true
}grok { patterns_dir => [ "/opt/logstash/patterns" ] match => [ "message", "%{SYSLOG5424PRI}(%{NUMBER:log_sequence#})?:( %{NUMBER}:)? %{CISCOTIMESTAMPTZ:log_date}: %%{CISCO_REASON:facility}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:message}", "message", "%{SYSLOG5424PRI}(%{NUMBER:log_sequence#})?:( %{NUMBER}:)? %{CISCOTIMESTAMPTZ:log_date}: %%{CISCO_REASON:facility}-%{CISCO_REASON:facility_sub}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:message}", "message", "%{SYSLOG5424PRI}(%{NUMBER:log_sequence#})?: %{NEXUSTIMESTAMP:log_date}: %%{CISCO_REASON:facility}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:message}", "message", "%{SYSLOG5424PRI}(%{NUMBER:log_sequence#})?: %{NEXUSTIMESTAMP:log_date}: %%{CISCO_REASON:facility}-%{CISCO_REASON:facility_sub}-%{INT:severity_level}-%{CISCO_REASON:facility_mnemonic}: %{GREEDYDATA:message}" ] overwrite => [ "message" ] add_tag => [ "cisco" ] remove_field => [ "syslog5424_pri", "@version" ] }}
if "cisco" in [tags] {
date {
match => [
"log_date",
"MMM dd HH:mm:ss.SSS ZZZ",
"MMM dd HH:mm:ss ZZZ",
"MMM dd HH:mm:ss.SSS",
"YYYY MMM dd HH:mm:ss.SSS ZZZ",
"YYYY MMM dd HH:mm:ss ZZZ",
"YYYY MMM dd HH:mm:ss.SSS",
"ISO8601"
]
}# Add the log level's name instead of just a number. mutate { gsub => [ "severity_level", "0", "0 - Emergency", "severity_level", "1", "1 - Alert", "severity_level", "2", "2 - Critical", "severity_level", "3", "3 - Error", "severity_level", "4", "4 - Warning", "severity_level", "5", "5 - Notification", "severity_level", "6", "6 - Informational" ] }}
}
100-outputs.conf
output {
if "_grokparsefailure" in [tags] {
file {
path => "/tmp/fail-%{type}-%{+YYYY.MM.dd}.log"
}
}
if "cisco" in [tags] {
file {
path => "/tmp/%{type}-%{+YYYY.MM.dd}.log"
}elasticsearch { hosts => ["localhost:9200"] index => "network-%{+YYYY.MM.dd}" document_type => "%{type}" document_id => "%{fingerprint}" }}
}
I'm convinced it's a logstash related problem as I would expect to see it in one of the logs defined in the output config. Unfortunately, it just seems to disappear entirely.
Any assistance would be greatly appreciated, thanks in advance.