# Logstash Filter for Cisco ASA Source Destination and Communication

**URL:** <https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063>\
**Category:** Logstash\
**Created:** [December 28, 2022, 4:06am UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063 "2022-12-28T04:06:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pratik\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pratik_srivastava/32/115287_2.png) [@Pratik\_Srivastava](https://discuss.elastic.co/u/Pratik_Srivastava)\
**Post date:** [December 28, 2022, 4:06am UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063/1 "2022-12-28T04:06:46Z")

</div>

I want to configure logstash filter to see asa logs with communication detail.

# LOG Sample:

# Dec 27 02:48:08 Test-FW : %ASA-6-302014: Teardown TCP connection 3505833084 for Test-OUT:192.168.1.10/58538 to Mgmt-IN:192.168.100.10/1159 duration 0:00:00 bytes 4153 TCP FINs from Test-OUT

Need for Below Data filter: Source IP: 192.168.1.10 Destination IP: 192.168.100.10 Source Port: 58538 Destination Port: 1159 Source Zone: Test-OUT Destination Zone: Mgmt-IN Protocol: TCP Device Name: Test-FW Size: 4153 Bytes (Optional)

# Below configuraiton not working:

```auto
input {
beats {
port => 5044
}
}
filter {
grok {
id => "ASA"
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
# add_field => ["received_at", "%{@timestamp}"]
# add_field => ["received_from", "%{host}"] }

}
grok {
id => "ALLOW-SRC-DST"
match => { "syslog_message" => "inside:%{HOSTNAME:inside_host}/%{NUMBER:inside_port} to outside:%{HOSTNAME:outside_host}/%{NUMBER:outside_port}" }
}
#syslog_pri { }
# date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
# }
}

output {
if [@metadata][pipeline] {
elasticsearch {
hosts => ["http://localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
}
}
else {
elasticsearch {
hosts => ["http://localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 28, 2022, 3:59pm UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063/2 "2022-12-28T15:59:02Z")

</div>

Why not use the [predefined](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/legacy/firewalls) firewall patterns that know how to parse ASA log messages?

---

<div class="post-metadata">

**Author:** ![Pratik\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pratik_srivastava/32/115287_2.png) [@Pratik\_Srivastava](https://discuss.elastic.co/u/Pratik_Srivastava)\
**Post date:** [December 28, 2022, 6:32pm UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063/3 "2022-12-28T18:32:10Z")

</div>

its not working, i just pasted the filter mentioned in link to logstash filter.conf and getting errors.

# Config file

filter {  
#== Cisco ASA ==  
CISCO\_TAGGED\_SYSLOG ^\<%{POSINT:syslog\_pri}\>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}:  
CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}  
CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9\_]+)

# Common Particles

CISCO\_ACTION Built|Teardown|Deny|Denied|denied|requested|permitted|denied by ACL|discarded|est-allowed|Dropping|created|deleted  
CISCO\_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s\*)\*  
CISCO\_DIRECTION Inbound|inbound|Outbound|outbound  
CISCO\_INTERVAL first hit|%{INT}-second interval  
CISCO\_XLATE\_TYPE static|dynamic

# ASA-1-104001

CISCOFW104001 ((?:Primary|Secondary)) Switching to ACTIVE - %{GREEDYDATA:switch\_reason}

# ASA-1-104002

CISCOFW104002 ((?:Primary|Secondary)) Switching to STANDBY - %{GREEDYDATA:switch\_reason}

# ASA-1-104003

CISCOFW104003 ((?:Primary|Secondary)) Switching to FAILED.

# ASA-1-104004

CISCOFW104004 ((?:Primary|Secondary)) Switching to OK.

# ASA-1-105003

CISCOFW105003 ((?:Primary|Secondary)) Monitoring on [Ii]nterface %{GREEDYDATA:interface\_name} waiting

# ASA-1-105004

CISCOFW105004 ((?:Primary|Secondary)) Monitoring on [Ii]nterface %{GREEDYDATA:interface\_name} normal

# ASA-1-105005

CISCOFW105005 ((?:Primary|Secondary)) Lost Failover communications with mate on [Ii]nterface %{GREEDYDATA:interface\_name}

# ASA-1-105008

CISCOFW105008 ((?:Primary|Secondary)) Testing [Ii]nterface %{GREEDYDATA:interface\_name}

# ASA-1-105009

CISCOFW105009 ((?:Primary|Secondary)) Testing on [Ii]nterface %{GREEDYDATA:interface\_name} (?:Passed|Failed)

# ASA-2-106001

CISCOFW106001 %{CISCO\_DIRECTION:direction} %{WORD:protocol} connection %{CISCO\_ACTION:action} from %{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:dst\_port} flags %{GREEDYDATA:tcp\_flags} on interface %{GREEDYDATA:interface}

# ASA-2-106006, ASA-2-106007, ASA-2-106010

CISCOFW106006\_106007\_106010 %{CISCO\_ACTION:action} %{CISCO\_DIRECTION:direction} %{WORD:protocol} (?:from|src) %{IP:src\_ip}/%{INT:src\_port}((%{DATA:src\_fwuser}))? (?:to|dst) %{IP:dst\_ip}/%{INT:dst\_port}((%{DATA:dst\_fwuser}))? (?:on interface %{DATA:interface}|due to %{CISCO\_REASON:reason})

# ASA-3-106014

CISCOFW106014 %{CISCO\_ACTION:action} %{CISCO\_DIRECTION:direction} %{WORD:protocol} src %{DATA:src\_interface}:%{IP:src\_ip}((%{DATA:src\_fwuser}))? dst %{DATA:dst\_interface}:%{IP:dst\_ip}((%{DATA:dst\_fwuser}))? (type %{INT:icmp\_type}, code %{INT:icmp\_code})

# ASA-6-106015

CISCOFW106015 %{CISCO\_ACTION:action} %{WORD:protocol} (%{DATA:policy\_id}) from %{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:dst\_port} flags %{DATA:tcp\_flags} on interface %{GREEDYDATA:interface}

# ASA-1-106021

CISCOFW106021 %{CISCO\_ACTION:action} %{WORD:protocol} reverse path check from %{IP:src\_ip} to %{IP:dst\_ip} on interface %{GREEDYDATA:interface}

# ASA-4-106023

CISCOFW106023 %{CISCO\_ACTION:action}( protocol)? %{WORD:protocol} src %{DATA:src\_interface}:%{DATA:src\_ip}(/%{INT:src\_port})?((%{DATA:src\_fwuser}))? dst %{DATA:dst\_interface}:%{DATA:dst\_ip}(/%{INT:dst\_port})?((%{DATA:dst\_fwuser}))?( (type %{INT:icmp\_type}, code %{INT:icmp\_code}))? by access-group "?%{DATA:policy\_id}"? [%{DATA:hashcode1}, %{DATA:hashcode2}]

# ASA-4-106100, ASA-4-106102, ASA-4-106103

CISCOFW106100\_2\_3 access-list %{NOTSPACE:policy\_id} %{CISCO\_ACTION:action} %{WORD:protocol} for user '%{DATA:src\_fwuser}' %{DATA:src\_interface}/%{IP:src\_ip}(%{INT:src\_port}) -\> %{DATA:dst\_interface}/%{IP:dst\_ip}(%{INT:dst\_port}) hit-cnt %{INT:hit\_count} %{CISCO\_INTERVAL:interval} [%{DATA:hashcode1}, %{DATA:hashcode2}]

# ASA-5-106100

CISCOFW106100 access-list %{NOTSPACE:policy\_id} %{CISCO\_ACTION:action} %{WORD:protocol} %{DATA:src\_interface}/%{IP:src\_ip}(%{INT:src\_port})((%{DATA:src\_fwuser}))? -\> %{DATA:dst\_interface}/%{IP:dst\_ip}(%{INT:dst\_port})((%{DATA:src\_fwuser}))? hit-cnt %{INT:hit\_count} %{CISCO\_INTERVAL:interval} [%{DATA:hashcode1}, %{DATA:hashcode2}]

# ASA-5-304001

CISCOFW304001 %{IP:src\_ip}((%{DATA:src\_fwuser}))? Accessed URL %{IP:dst\_ip}:%{GREEDYDATA:dst\_url}

# ASA-6-110002

CISCOFW110002 %{CISCO\_REASON:reason} for %{WORD:protocol} from %{DATA:src\_interface}:%{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:dst\_port}

# ASA-6-302010

CISCOFW302010 %{INT:connection\_count} in use, %{INT:connection\_count\_max} most used

# ASA-6-302013, ASA-6-302014, ASA-6-302015, ASA-6-302016

CISCOFW302013\_302014\_302015\_302016 %{CISCO\_ACTION:action}(?: %{CISCO\_DIRECTION:direction})? %{WORD:protocol} connection %{INT:connection\_id} for %{DATA:src\_interface}:%{IP:src\_ip}/%{INT:src\_port}( (%{IP:src\_mapped\_ip}/%{INT:src\_mapped\_port}))?((%{DATA:src\_fwuser}))? to %{DATA:dst\_interface}:%{IP:dst\_ip}/%{INT:dst\_port}( (%{IP:dst\_mapped\_ip}/%{INT:dst\_mapped\_port}))?((%{DATA:dst\_fwuser}))?( duration %{TIME:duration} bytes %{INT:bytes})?(?: %{CISCO\_REASON:reason})?( (%{DATA:user}))?

# ASA-6-302020, ASA-6-302021

CISCOFW302020\_302021 %{CISCO\_ACTION:action}(?: %{CISCO\_DIRECTION:direction})? %{WORD:protocol} connection for faddr %{IP:dst\_ip}/%{INT:icmp\_seq\_num}(?:(%{DATA:fwuser}))? gaddr %{IP:src\_xlated\_ip}/%{INT:icmp\_code\_xlated} laddr %{IP:src\_ip}/%{INT:icmp\_code}( (%{DATA:user}))?

# ASA-6-305011

CISCOFW305011 %{CISCO\_ACTION:action} %{CISCO\_XLATE\_TYPE:xlate\_type} %{WORD:protocol} translation from %{DATA:src\_interface}:%{IP:src\_ip}(/%{INT:src\_port})?((%{DATA:src\_fwuser}))? to %{DATA:src\_xlated\_interface}:%{IP:src\_xlated\_ip}/%{DATA:src\_xlated\_port}

# ASA-3-313001, ASA-3-313004, ASA-3-313008

CISCOFW313001\_313004\_313008 %{CISCO\_ACTION:action} %{WORD:protocol} type=%{INT:icmp\_type}, code=%{INT:icmp\_code} from %{IP:src\_ip} on interface %{DATA:interface}( to %{IP:dst\_ip})?

# ASA-4-313005

CISCOFW313005 %{CISCO\_REASON:reason} for %{WORD:protocol} error message: %{WORD:err\_protocol} src %{DATA:err\_src\_interface}:%{IP:err\_src\_ip}((%{DATA:err\_src\_fwuser}))? dst %{DATA:err\_dst\_interface}:%{IP:err\_dst\_ip}((%{DATA:err\_dst\_fwuser}))? (type %{INT:err\_icmp\_type}, code %{INT:err\_icmp\_code}) on %{DATA:interface} interface. Original IP payload: %{WORD:protocol} src %{IP:orig\_src\_ip}/%{INT:orig\_src\_port}((%{DATA:orig\_src\_fwuser}))? dst %{IP:orig\_dst\_ip}/%{INT:orig\_dst\_port}((%{DATA:orig\_dst\_fwuser}))?

# ASA-5-321001

CISCOFW321001 Resource '%{WORD:resource\_name}' limit of %{POSINT:resource\_limit} reached for system

# ASA-4-402117

CISCOFW402117 %{WORD:protocol}: Received a non-IPSec packet (protocol= %{WORD:orig\_protocol}) from %{IP:src\_ip} to %{IP:dst\_ip}

# ASA-4-402119

CISCOFW402119 %{WORD:protocol}: Received an %{WORD:orig\_protocol} packet (SPI= %{DATA:spi}, sequence number= %{DATA:seq\_num}) from %{IP:src\_ip} (user= %{DATA:user}) to %{IP:dst\_ip} that failed anti-replay checking

# ASA-4-419001

CISCOFW419001 %{CISCO\_ACTION:action} %{WORD:protocol} packet from %{DATA:src\_interface}:%{IP:src\_ip}/%{INT:src\_port} to %{DATA:dst\_interface}:%{IP:dst\_ip}/%{INT:dst\_port}, reason: %{GREEDYDATA:reason}

# ASA-4-419002

CISCOFW419002 %{CISCO\_REASON:reason} from %{DATA:src\_interface}:%{IP:src\_ip}/%{INT:src\_port} to %{DATA:dst\_interface}:%{IP:dst\_ip}/%{INT:dst\_port} with different initial sequence number

# ASA-4-500004

CISCOFW500004 %{CISCO\_REASON:reason} for protocol=%{WORD:protocol}, from %{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:dst\_port}

# ASA-6-602303, ASA-6-602304

CISCOFW602303\_602304 %{WORD:protocol}: An %{CISCO\_DIRECTION:direction} %{GREEDYDATA:tunnel\_type} SA (SPI= %{DATA:spi}) between %{IP:src\_ip} and %{IP:dst\_ip} (user= %{DATA:user}) has been %{CISCO\_ACTION:action}

# ASA-7-710001, ASA-7-710002, ASA-7-710003, ASA-7-710005, ASA-7-710006

CISCOFW710001\_710002\_710003\_710005\_710006 %{WORD:protocol} (?:request|access) %{CISCO\_ACTION:action} from %{IP:src\_ip}/%{INT:src\_port} to %{DATA:dst\_interface}:%{IP:dst\_ip}/%{INT:dst\_port}

# ASA-6-713172

CISCOFW713172 Group = %{GREEDYDATA:group}, IP = %{IP:src\_ip}, Automatic NAT Detection Status:\s+Remote end\s\*%{DATA:is\_remote\_natted}\s_behind a NAT device\s+This\s+end\s_%{DATA:is\_local\_natted}\s\*behind a NAT device

# ASA-4-733100

CISCOFW733100 [\s\*%{DATA:drop\_type}\s\*] drop %{DATA:drop\_rate\_id} exceeded. Current burst rate is %{INT:drop\_rate\_current\_burst} per second, max configured rate is %{INT:drop\_rate\_max\_burst}; Current average rate is %{INT:drop\_rate\_current\_avg} per second, max configured rate is %{INT:drop\_rate\_max\_avg}; Cumulative total count is %{INT:drop\_total\_count}  
#== End Cisco ASA ==

# Shorewall firewall logs

SHOREWALL (%{SYSLOGTIMESTAMP:timestamp}) (%{WORD:nf\_host}) .\*Shorewall:(%{WORD:nf\_action1})?:(%{WORD:nf\_action2})?._IN=(%{USERNAME:nf\_in\_interface})?._(OUT= \*MAC=(%{COMMONMAC:nf\_dst\_mac}):(%{COMMONMAC:nf\_src\_mac})?|OUT=%{USERNAME:nf\_out\_interface}).\*SRC=(%{IPV4:nf\_src\_ip}).\*DST=(%{IPV4:nf\_dst\_ip})._LEN=(%{WORD:nf\_len}).?TOS=(%{WORD:nf\_tos}).?PREC=(%{WORD:nf\_prec}).?TTL=(%{INT:nf\_ttl}).?ID=(%{INT:nf\_id}).?PROTO=(%{WORD:nf\_protocol}).?SPT=(%{INT:nf\_src\_port}?.DPT=%{INT:nf\_dst\_port}?.)  
#== End Shorewall  
#== SuSE Firewall 2 ==  
SFW2 ((%{SYSLOGTIMESTAMP:timestamp})|(%{TIMESTAMP\_ISO8601:timestamp}))\s%{HOSTNAME}\skernel\S+\s(?:%{NAGIOSTIME}\s)?SFW2-INext-%{NOTSPACE:nf\_action}\sIN=%{USERNAME:nf\_in\_interface}.OUT=(\s%{USERNAME:nf\_out\_interface})?\sMAC=((%{COMMONMAC:nf\_dst\_mac}:%{COMMONMAC:nf\_src\_mac})|(\s_))._SRC=%{IP:nf\_src\_ip}\s_DST=%{IP:nf\_dst\_ip}.\*PROTO=%{WORD:nf\_protocol}((.\*SPT=%{INT:nf\_src\_port}._DPT=%{INT:nf\_dst\_port}._)|())  
#== End SuSE ==  
}

# ============================================================================= ERROR

[2022-12-28T23:59:35,246][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties  
[2022-12-28T23:59:35,255][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.17.8", "jruby.version"=\>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.17+8 on 11.0.17+8 +indy +jit [linux-x86\_64]"}  
[2022-12-28T23:59:35,257][INFO][logstash.runner] JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djdk.io.File.enableADS=true, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -Djruby.regexp.interruptible=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true]  
[2022-12-28T23:59:35,525][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2022-12-28T23:59:36,530][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600, :ssl\_enabled=\>false}  
[2022-12-28T23:59:37,192][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "{" at line 3, column 21 (byte 47) after filter {\n#== Cisco ASA ==\nCISCO\_TAGGED\_SYSLOG ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:392:in `block in converge\_state'"]}  
[2022-12-28T23:59:37,261][INFO][logstash.runner] Logstash shut down.  
[2022-12-28T23:59:37,269][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 28, 2022, 6:38pm UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063/4 "2022-12-28T18:38:38Z")

</div>

> [@Pratik\_Srivastava](#):
>
> filter {  
> #== Cisco ASA ==  
> CISCO\_TAGGED\_SYSLOG ^\<%{POSINT:syslog\_pri}\>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}:  
> CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}  
> CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9\_]+)

This will not work, your configuration is wrong, you should not paste the patterns in your configuration, they are already available internally to Logstash.

This is the cause of this error:

> [2022-12-28T23:59:37,192][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "{" at line 3, column 21 (byte 47) after filter {\n#== Cisco ASA ==\nCISCO\_TAGGED\_SYSLOG "

What you need to do is use them in your grok filters.

Something like this:

```auto
grok {
    match => { "syslog_message" => "%{CISCOFW302013_302014_302015_302016}" }
}

```

---

<div class="post-metadata">

**Author:** ![Pratik\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pratik_srivastava/32/115287_2.png) [@Pratik\_Srivastava](https://discuss.elastic.co/u/Pratik_Srivastava)\
**Post date:** [December 28, 2022, 7:08pm UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063/5 "2022-12-28T19:08:42Z")

</div>

still not working:

Using Below:  
filter {  
grok {  
match =\> { "syslog\_message" =\> "%{CISCOFW302013\_302014\_302015\_302016}" }  
}  
}  
~

Error:

- beats\_input\_codec\_plain\_applied
- \_grokparsefailure

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [December 28, 2022, 9:41pm UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063/6 "2022-12-28T21:41:31Z")

</div>

This should work. I have followed logic: # ASA-6-302013, **ASA-6-302014** , ASA-6-302015, ASA-6-302016. If you want ECS, then use [this](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/firewalls). TCP FINs is explained [here](https://community.cisco.com/t5/network-security/what-does-tcp-fins-mean-at-the-end-of-the-log/td-p/833180).

```auto
filter {
 grok {
  id => "ASA"
  match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %%{DATA:asa}: %{CISCO_ACTION:action} %{WORD:protocol} connection %{INT:connection_id} for %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}( duration %{TIME:duration} bytes %{INT:bytes})? %{CISCO_REASON:reason} from %{GREEDYDATA:src_interface}" }
 }
}

```

Sorry for the pic, should be a proof.

 ![ASA-log](https://us1.discourse-cdn.com/elastic/original/3X/0/5/053a4d025dd82b74dc3deac612228bd775c60a2a.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 25, 2023, 9:41pm UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063/7 "2023-01-25T21:41:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.