Logstash Grok filter Not working

Elastic Stack Logstash
1 
<181>Jan 28 14:49:00 cisco CISE_RADIUS_Accounting 0001444968 1 0 2026-01-28 14:49:00.791 +00:00 0794387998 3002 NOTICE Radius-Accounting: RADIUS Accounting watchdog update, ConfigVersionId=312, Device IP Address=1.1.1.1, UserName=asdwe, NetworkDeviceName=ASD-3451-02, 
User-Name=asdasdasda, NAS-IP-Address=1.1.1.1, NAS-Port=234, Framed-IP-Address=1.1.1.1, Class=CACS:fsdfdsfsdfsdfsdf:2344/546510917/40333559, Called-Station-ID=00-00-00-00-000, Calling-Station-ID=00-00-00-00-000, NAS-Identifier=aasd-asdasd-02, Acct-Status-Type=Interim-Update, 
Acct-Delay-Time=0, Acct-Input-Octets=4866172, Acct-Output-Octets=2952901, Acct-Session-Id=00018c74, Acct-Authentic=Remote, Acct-Input-Packets=7953, Acct-Output-Packets=4770, Acct-Input-Gigawords=0, Acct-Output-Gigawords=0, Event-Timestamp=1769611740, NAS-Port-Type=Wireless - IEEE 
802.11, NAS-Port-Id=asdasd-234234, Framed-IPv6-Address=123::144b:234:sdf:234, cisco-av-pair=audit-session-id=5BFD290A0007313704E493AF, cisco-av-pair=vlan-id=111, cisco-av-pair=method=dot1x, cisco-av-pair=cisco-wlan-ssid=MOBILE, cisco-av-pair=wlan-profile-name=MOBILE, 
Airespace-Wlan-Id=123, AcsSessionID=sdf123/546510917/40338310, SelectedAccessService=ALLOWED, RequestLatency=3, Step=11004, Step=11017, Step=15049, Step=15008, Step=22085, Step=11005, NetworkDeviceGroups=Location#All Locations#asdasdas#asdasdasdasd GR, NetworkDeviceGroups=Device 
Type#All Device Types#WIRELESS, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, CPMSessionID=5BFD290A0007313704E493AF, StepLatency=1=0;2=1;3=0;4=2;5=0, TotalAuthenLatency=3, ClientLatency=0, Network Device Profile=Cisco, Location=Location#All Locations#asdsa#asdsadasd GR, Device 
Type=Device Type#All Device Types#WIRELESS, IPSEC=IPSEC#Is IPSEC Device#No,

Both these If statements dont work

filter looks like this

filter {
if  "CISE" in [message]
{
grok {
match => { "message" => "<%{INT:priority}>%{SYSLOGTIMESTAMP:syslog_ts} %{HOSTNAME:hostname} %{WORD:program} %{INT:session_id} %{INT:flag1} %{INT:flag2} %{TIMESTAMP_ISO8601:timestamp} %{INT:offset}:%{INT:code} %{INT:subcode} %{INT:subcode2} %{LOGLEVEL:log_level}\s+%{WORD:Profiler}: %{DATA:Profiler1}, %{GREEDYDATA:restOfLine}" }
}
kv {
source => "restOfLine"
field_split => ","
trim_key => " "
value_split => "="
}
mutate {
remove_field => [ "message", "restOfLine" ]
add_field => { "devicevendor" => "cisco" }
add_field => { "deviceproduct" => "ise" }
}

}

else if  "CISE" in [message]
{
grok {
match => {  "message" =>  "^<%{INT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:host} %{WORD:ise_service} %{INT:msg_id} %{INT} %{INT} %{TIMESTAMP_ISO8601:event_time} %{INT:sequence} %{INT:message_code} %{LOGLEVEL:log_level} Radius-Accounting: %{GREEDYDATA:kv_payload}$" }
}
kv {
source => "kv_payload"
field_split => ", "
value_split => "="
trim_key => " "
trim_value => " "
allow_duplicate_values => true
target => "radius"
}

if [radius][cisco-av-pair] {
kv {
source => "[radius][cisco-av-pair]"
value_split => "="
target => "[radius][cisco]"
}
}
}

}
2

Grok Debugger, says the first if statement should parse it fine but i am getting a _grokparsefailure

3

Cisco ISE logs are a nightmare, there are a lot of things that can break your grok and you need to keep fixing it until you have a working version.

I would recommend that you switch to the Elastic Agent Cisco ISE integration that does a better job and has this parsing already done.

1 Like
4

I have a git request for it , it doesnt support Profiler logs yet so i have to use this, which is why i have a if ( profiler first one ) but it should work for this Accounting log as its the same so thats why i split it into 2 , i know the first if statement works for the profiler and the 2nd for the accoounting

5

I am not sure this matches the +00:00 in the log line shared?

But don't chase your own tail here, and do what @leandrojmp suggested if you can.

6

Well it is never going to go through the else if because you are using the same test in both conditionals. If "CISE" in [message] it will never get to the second grok.

The first grok doesn’t match because "Profiler" => "Radius-Accounting" contains a hyphen, which means it does not match %{WORD}. You could change that to %{NOTSPACE} to make it work.

To debug patterns like this start with

match => { "message" => "<%{INT:priority}>%{GREEDYDATA:restOfLine}"

and then add one field at a time until it stops working. The last field you add is the one that needs to change.

1 Like
7

wow… a - threw off a word vs nospace Thanks!