# Need help with log filtering

**URL:** https://discuss.elastic.co/t/need-help-with-log-filtering/92739
**Category:** Logstash
**Created:** [July 12, 2017, 12:45am UTC](https://discuss.elastic.co/t/need-help-with-log-filtering/92739 "2017-07-12T00:45:00Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Leon1](https://avatars.discourse-cdn.com/v4/letter/l/a88e57/32.png) [@Leon1](https://discuss.elastic.co/u/Leon1)
#### Post date: [July 12, 2017, 12:45am UTC](https://discuss.elastic.co/t/need-help-with-log-filtering/92739/1 "2017-07-12T00:45:00Z")

</div>

Problem Description:  
I have the following log that needs to be filtered and I found that some of the Cisco ASA filter to be really useful.  
Jul 09 2017 23:34:50: %ASA-4-106023: Deny tcp src outside:1.2.3.4.5 ......

However, there is one issue, in all of the examples, ASA logs pattern is slightly different from mine. They all have a priority number at the beginning like this:  
\<123\>Jul 09 2017 23:34:50: %ASA-4-106023: Deny tcp src outside:1.2.3.4.5 ......

Using the same filter pattern obviously caused trouble and the parse was incomplete, which resulted the timestamp to be incorrectly parsed. The \<123\> portion is filtered by syslog\_pri { }, which is part of the {CISCO\_TAGGED\_SYSLOG}. This all built-in within the plugin, so I can't really change anything. Here is the grok library [http://grokconstructor.appspot.com/groklib/firewalls](http://grokconstructor.appspot.com/groklib/firewalls)

Below is my code that filters it, I thought I could get away by removing the "syslog\_pri {}", but that didn't work.

```
grok {
  match => ["message", "%{CISCO_TAGGED_SYSLOG} %{GREEDYDATA:cisco_message}"]
}

# Parse the syslog severity and facility
syslog_pri { }

# Parse the date from the "timestamp" field to the "@timestamp" field
date {
  match => ["timestamp",
    "MMM dd HH:mm:ss",
    "MMM d HH:mm:ss",
    "MMM dd yyyy HH:mm:ss",
    "MMM d yyyy HH:mm:ss"
  ]
  timezone => "America/New_York"
}

```

so my question is: is there anyway that I can skip the part where the regex is look for \<123\> ? I'd imagine that I could somehow put a regex to negate \<123\> regex in front of the {CISCO\_TAGGED\_SYSLOG} portion ?

Thanks for any help !!

---

<div class="post-metadata">

### Author: ![Leon1](https://avatars.discourse-cdn.com/v4/letter/l/a88e57/32.png) [@Leon1](https://discuss.elastic.co/u/Leon1)
#### Post date: [July 12, 2017, 1:05am UTC](https://discuss.elastic.co/t/need-help-with-log-filtering/92739/2 "2017-07-12T01:05:51Z")

</div>

OK, i figured it out, by simply breaking down the {CISCO\_TAGGED\_SYSLOG} portion into the following

%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}: %{GREEDYDATA:cisco\_message}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 9, 2017, 1:06am UTC](https://discuss.elastic.co/t/need-help-with-log-filtering/92739/3 "2017-08-09T01:06:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.