# Logtssh Grok for Cisco ISE **URL:** \ **Category:** Logstash\ **Created:** [September 18, 2025, 1:52pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057 "2025-09-18T13:52:50Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Post date:** [September 18, 2025, 1:52pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/1 "2025-09-18T13:52:50Z")
I have this Filter and its not parsing correctly , ```auto filter { match => { "message" => "<%{INT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_ts} %{HOSTNAME:host} %{WORD:module} %{INT:session_id} %{INT:severity} %{INT:msg_id} %{GREEDYDATA:restOfLine}" } } kv { source => "restOfLine" field_split => "," trim_key => "\\" value_split => "=" } mutate { remove_field => ["message", "restOfLine"] add_field => { "devicevendor" => "cisco" } add_field => { "deviceproduct" => "ise" } } } ``` | \<182\>Sep 18 13:46:04 ise03 CISE\_Profiler 0000000251 1 0 2025-09-18 13:46:04.744 +00:00 0179839630 80002 INFO Profiler: Profiler EndPoint profiling event occurred, ConfigVersionId=159, OperatingSystem=Windows 11 Enterprise, EndpointCertainityMetric=5, EndpointIPAddress=0.0.0.0 | | --- | | | ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 18, 2025, 2:26pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/2 "2025-09-18T14:26:56Z")
As written, that will fail to compile for two reasons. Firstly, it is missing the “grok {“ for the first filter. Secondly, you cannot escape a backslash at the end of a string. This is discussed at length in [this](https://github.com/elastic/logstash/issues/9701) github issue. However, I see no reason to try to trim backslash from the keys, you probably want to trim spaces instead, in which case it should work if you try ```auto kv { source => "restOfLine" field_split => "," trim_key => " " value_split => "=" remove_field => ["restOfLine"] } ``` ---
**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Post date:** [September 18, 2025, 3:05pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/3 "2025-09-18T15:05:34Z")
> [@Badger](#): > > stly, it is missing the “grok {“ for I missed that but still nothing , ```auto ``` ```auto <182>Sep 18 14:29:13 ise03 CISE_Profiler 0000000255 1 0 2025-09-18 14:29:13.635 +00:00 0180184437 80002 INFO Profiler: Profiler EndPoint profiling event occurred, ConfigVersionId=159, OperatingSystem=Apple iOS ``` ```auto ``` ```auto filter { grok { match => { "message" => "<%{INT:priority}>%{SYSLOGTIMESTAMP:syslog_ts} %{HOSTNAME:hostname} %{WORD:program} %{INT:session_id} %{INT:flag1} %{INT:flag2} %{TIMESTAMP_ISO8601:timestamp} %{INT:offset}:%{INT:code} %{INT:subcode} %{INT:subcode2} %{LOGLEVEL:log_level} %{WORD:Profiler}: %{DATA:Profiler1}, %{GREEDYDATA:restOfLine}" } } kv { source => "restOfLine" field_split => "," trim_key => " " value_split => "=" } mutate { remove_field => ["message", "restOfLine"] add_field => { "devicevendor" => "cisco" } add_field => { "deviceproduct" => "ise" } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 18, 2025, 4:07pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/4 "2025-09-18T16:07:21Z")
> [@Elk\_huh](#): > > I missed that but still nothing So what is happening? Does logstash successfully start the pipeline? Does it log any errors? What do you get on stdout if you add ```auto output { stdout { codec => rubydebug } } ``` ---
**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Post date:** [September 18, 2025, 6:53pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/7 "2025-09-18T18:53:49Z")
I get a grok error | message | \<179\>Sep 18 18:38:14 ise CISE\_Profiler 0000000263 1 0 2025-09-18 18:38:14.661 +00:00 0182114190 80009 ERROR Profiler: Profiler SNMP request failure, ConfigVersionId=159, EndpointNADAddress=1.1.1.1, [ProfilerServer=ise.com](http://ProfilerServer=ise.com), SNMPOIDValue=ifDescr, ProfilerErrorMessage=Request timed out., | | --- | --- | | | tags[tcp/514, \_grokparsefailure] | ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 18, 2025, 7:03pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/8 "2025-09-18T19:03:30Z")
> [@Elk\_huh](#): > > I get a grok error That’s because your grok pattern has two spaces following the log level, which may work for INFO, but not for ERROR. Try editing the pattern to use ```auto %{LOGLEVEL:log_level}\s+%{WORD:Profiler}: ``` ---
**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Post date:** [September 19, 2025, 1:16pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/11 "2025-09-19T13:16:22Z")
> [@Elk\_huh](#): > > g because , INFO won this seems to work! , \s will account for any spaces ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 19, 2025, 1:45pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/12 "2025-09-19T13:45:35Z")
> [@Elk\_huh](#): > > \s will account for any spaces ? \s will match exactly one whitespace character. \s+ will match one or more, \s\* will match zero or more. ---
**Author:** ![justin.Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin.elastic/32/130913_2.png) [@justin.Elastic](https://discuss.elastic.co/u/justin.Elastic)\ **Post date:** [October 15, 2025, 8:33am UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/13 "2025-10-15T08:33:50Z")
@Elk_huh just a side question, why not use the integration that comes with Elastic, even if you don’t use the agent to collect, you could use the pipeline it provides which should have a great starting point for your parsing? [Cisco ISE | Elastic integrations](https://www.elastic.co/docs/reference/integrations/cisco_ise) ---
**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Post date:** [October 15, 2025, 12:52pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/16 "2025-10-15T12:52:29Z")
Hi Justin!, You know that would be amazing as we are trying to move away from Logstash Elastic Agent - Cisco ISE integration doesnt parse Profiler logs from ISE, so if you can get this on the roadmap this would be great! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 15, 2025, 1:02pm UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/17 "2025-10-15T13:02:17Z")
> [@Elk\_huh](#): > > Elastic Agent - Cisco ISE integration doesnt parse Profiler logs from ISE, so if you can get this on the roadmap this would be great! You could open an issue in the Integreations repository so someone can take a look into it. It is this one: [GitHub - elastic/integrations](https://github.com/elastic/integrations) ---
**Author:** ![justin.Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin.elastic/32/130913_2.png) [@justin.Elastic](https://discuss.elastic.co/u/justin.Elastic)\ **Post date:** [October 16, 2025, 10:59am UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057/18 "2025-10-16T10:59:32Z")
I see you have created the Request already, The dev Team is now aware. Was also wondering if you had tried creating your own integration through the Automatic Import feature: [Automatic import | Elastic Docs](https://www.elastic.co/docs/solutions/security/get-started/automatic-import) might be quicker than trying to build your own integration using the custom Filestream option:[filestream input | Beats](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream)