# Logstash for cyberoam filtering
**URL:** https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644
**Category:** Logstash
**Created:** [February 19, 2017, 5:17pm UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644 "2017-02-19T17:17:13Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Ibrahim](https://discuss.elastic.co/u/Ibrahim)
#### Post date: [February 19, 2017, 5:17pm UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/1 "2017-02-19T17:17:13Z")
Dear All
I have an elk stack used with cyberoam, and I want to parse this message with logstash can you help me please:
"\<30\>date=2017-02-19 time=21:59:15 timezone="IST" device\_name="CR200iNG" device\_id=C20313272882-BQ2EUG log\_id=010302602002 log\_type="Firewall" log\_component="Appliance Access" log\_subtype="Denied" status="Deny" priority=Information duration=0 fw\_rule\_id=0 user\_name="" user\_gp="" iap=0 ips\_policy\_id=0 appfilter\_policy\_id=0 application="" application\_risk=0 application\_technology="" application\_category="" in\_interface="PortF" out\_interface="" src\_mac=dd:dd:dd:02:1c:e4 src\_ip=192.168.200.9 src\_country\_code= dst\_ip=255.255.255.255 dst\_country\_code= protocol="UDP" src\_port=32771 dst\_port=7423 sent\_pkts=0 recv\_pkts=0 sent\_bytes=0 recv\_bytes=0 tran\_src\_ip= tran\_src\_port=0 tran\_dst\_ip= tran\_dst\_port=0 srczonetype="" srczone="" dstzonetype="" dstzone="" dir\_disp="" connid="" vconnid=""",
and can you kindly tell me how to parse the captured packets using logstash, because there is an ability in the cyberoam to capture the packets in the network and I sent this data to logstash but logstash is not showing data in kibana
best regards
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 19, 2017, 10:22pm UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/2 "2017-02-19T22:22:19Z")
Have a look at the KV filter 🙂
---
### Author:  [@Ibrahim](https://discuss.elastic.co/u/Ibrahim)
#### Post date: [February 20, 2017, 5:37am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/3 "2017-02-20T05:37:07Z")
Thanks for your reply
I am using following:
```
kv {
source => "syslog_message"
}
mutate {
replace => ["type", %{syslog_program}"]
remove_field => ["syslog_message", "syslog_timestamp"]
}
```
but I'm not getting anything into my elasticsearch neither kibana
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 20, 2017, 5:45am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/4 "2017-02-20T05:45:21Z")
What does the rest of your config look like?
Have you tried a stdout?
What version are you on?
---
### Author:  [@Ibrahim](https://discuss.elastic.co/u/Ibrahim)
#### Post date: [February 20, 2017, 6:54am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/5 "2017-02-20T06:54:23Z")
```
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "utm-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
```
This is my output
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 20, 2017, 7:06am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/6 "2017-02-20T07:06:22Z")
Is there anything in stdout then?
---
### Author:  [@Ibrahim](https://discuss.elastic.co/u/Ibrahim)
#### Post date: [February 20, 2017, 7:08am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/7 "2017-02-20T07:08:15Z")
Yes there is this output when I do the configuration check
"\<14\>date" =\> "2017-02-20",
"time" =\> "12:10:52",
"timezone" =\> "IST",
"device\_name" =\> "CR200iNG",
"device\_id" =\> "C20313272882-BQ2EUG",
"log\_id" =\> "050901616001",
"log\_type" =\> "Content Filtering",
"log\_component" =\> "HTTP",
"log\_subtype" =\> "Allowed",
"status" =\> """",
"priority" =\> "Information",
"fw\_rule\_id" =\> "0",
"user\_name" =\> "bag21",
"user\_gp" =\> "Bag\_Emp",
"iap" =\> "13",
"category" =\> "Bag",
"category\_type" =\> "Productive",
"url" =\> "[kh.google.com/flatfile?f1c-0201211130221313231-t.383](http://kh.google.com/flatfile?f1c-0201211130221313231-t.383)",
"contenttype" =\> "application/octet-stream",
"override\_token" =\> """",
"httpresponsecode" =\> """",
"src\_ip" =\> "192.168.200.83",
"dst\_ip" =\> "100.50.197.46",
"protocol" =\> "TCP",
"src\_port" =\> "49864",
"dst\_port" =\> "80",
"sent\_bytes" =\> "0",
"recv\_bytes" =\> "110",
"domain" =\> "[kh.google.com](http://kh.google.com)"
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 20, 2017, 7:12am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/8 "2017-02-20T07:12:24Z")
It'd be useful if you provided your entire config as a single post.
---
### Author:  [@Ibrahim](https://discuss.elastic.co/u/Ibrahim)
#### Post date: [February 20, 2017, 7:16am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/9 "2017-02-20T07:16:35Z")
Thanks alot, I don't know that happened but after a couple of restart it worked but I still have this tage message
```
"tags" => [
[0] "_grokparsefailure",
```
do you know why?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 20, 2017, 7:16am UTC](https://discuss.elastic.co/t/logstash-for-cyberoam-filtering/75644/10 "2017-03-20T07:16:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.