zahid4
January 27, 2022, 11:14am
1
Im using the following configuration in the logstash to parse cisco logs and send to ELK:
logstash_cisco_asa
# Cisco ASA
filter {
if "syslog" in [tags] and "pre-processed" not in [tags] {
if "%ASA-" in [message] {
mutate {
add_tag => [ "pre-processed", "Firewall", "ASA" ]
}
grok {
match => [
"message", "<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp} %{SYSLOGHOST:sysloghost} %%{CISCOTAG:cisco_tag}: %{GREEDYDATA:cisco_message}"show original
Im getting "grokparsefailure" in logs tag of cisco ASA logs although the format is correct.
system
February 24, 2022, 11:14am
2
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.