# Logstash Core Plugin Firewall Patterns are outdated **URL:** \ **Category:** Logstash\ **Created:** [June 29, 2017, 5:40pm UTC](https://discuss.elastic.co/t/logstash-core-plugin-firewall-patterns-are-outdated/91326 "2017-06-29T17:40:31Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![DanMa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danma/32/18970_2.png) [@DanMa](https://discuss.elastic.co/u/DanMa)\ **Post date:** [June 29, 2017, 5:40pm UTC](https://discuss.elastic.co/t/logstash-core-plugin-firewall-patterns-are-outdated/91326/1 "2017-06-29T17:40:31Z")
Hey, iam trying to built up a Syslog Solution for my ASA Firewall. I use udp as Input.. I use this grok filter (and i get everytime a \_grokparsefailure): `%{CISCO_TAGGED_SYSLOG}%{GREEDYDATA:cisco_message}` After my comparison and a research of old tutorials it seems to be that cisco changed the style of the syslog message. Old Style: `<134>Sep 02 2014 11:50:10: %ASA-6-302013: Built inbound TCP connection 123456789 for inside:10.0.1.1/1234 (10.0.1.1/1234) to outside:10.0.2.2/80 (10.0.2.2/80)` New Style: `2017-06-29T16:40:54.582Z 1.2.3.4 <167>%ASA-7-710006: VRRP request discarded from 190.4.23.5 to OUTSIDE:224.0.0.10` The Logstash Core Plugin includes also only the Patterns for the old syslog style: `CISCO_TAGGED_SYSLOG ^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})?: %%{CISCOTAG:ciscotag}: CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME} CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9_]+)` Has anyone a Information when the core plugin would be updated? Best Regards Daniel ---
**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\ **Post date:** [June 30, 2017, 9:24am UTC](https://discuss.elastic.co/t/logstash-core-plugin-firewall-patterns-are-outdated/91326/2 "2017-06-30T09:24:15Z")
The old format will always have to be supported but I agree it's useful to also support new formats. Are you willing to submit a PR to [https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/firewalls#L5](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/firewalls#L5) that adds a new pattern? [Testing is also super easy](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/spec/patterns/firewalls_spec.rb#L5-L21) It'd be most welcome! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 28, 2017, 9:24am UTC](https://discuss.elastic.co/t/logstash-core-plugin-firewall-patterns-are-outdated/91326/3 "2017-07-28T09:24:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.