# Parsing Cisco ACS logs **URL:** \ **Category:** Logstash\ **Created:** [September 19, 2016, 1:13pm UTC](https://discuss.elastic.co/t/parsing-cisco-acs-logs/60887 "2016-09-19T13:13:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ANU\_SARA\_VARGHESE](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anu_sara_varghese/32/51487_2.png) [@ANU\_SARA\_VARGHESE](https://discuss.elastic.co/u/ANU_SARA_VARGHESE)\ **Post date:** [September 19, 2016, 1:13pm UTC](https://discuss.elastic.co/t/parsing-cisco-acs-logs/60887/1 "2016-09-19T13:13:22Z")
Hi, Is there is any predefined patterns through which Cisco ACS logs can be filtered like the syslog? ---
**Author:** ![Guy\_Sperry](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Guy\_Sperry](https://discuss.elastic.co/u/Guy_Sperry)\ **Post date:** [October 11, 2016, 11:00pm UTC](https://discuss.elastic.co/t/parsing-cisco-acs-logs/60887/2 "2016-10-11T23:00:07Z")
Have you had any success? I have been playing around with configs found here: [http://lists.adiscon.net/pipermail/rsyslog/2014-April/037243.html](http://lists.adiscon.net/pipermail/rsyslog/2014-April/037243.html) and here: [https://www.linkedin.com/pulse/cisco-syslog-logstash-daniel-gilbertson-5994871489260695552](https://www.linkedin.com/pulse/cisco-syslog-logstash-daniel-gilbertson-5994871489260695552) but I have not had any luck yet. ---
**Author:** ![kumar21000](https://avatars.discourse-cdn.com/v4/letter/k/3d9bf3/32.png) [@kumar21000](https://discuss.elastic.co/u/kumar21000)\ **Post date:** [October 12, 2016, 3:05pm UTC](https://discuss.elastic.co/t/parsing-cisco-acs-logs/60887/3 "2016-10-12T15:05:53Z")
Hey Guys, May be I can help you 🙂 as far as I know there is no predefined patterns for ACS in logstash In my setup I have 10 ACS servers, which sending more or less 100 logs per seconds. I have created the attached filters based on my requirements with the help of google 🙂 I am not able to attach config text file here, looks authorization issue. If you dont mind, you can share your email id, i will sent it to you, and do the necessary modification to fit your needs, kindly remember, most of the ACS logs are multiline, and Logstash use single thread for multiline filter. In my setup, I am using KV and prune filters also, so you need to install those filters in logstash. And you need to load the ACS pattern also which I have attached. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/parsing-cisco-acs-logs/60887/4 "2017-07-06T04:34:31Z")