Parsing Cisco ASA Log

Elastic Stack Logstash
1

I'm trying to parse Cisco logs to only show message 106023 and 106100 which are the permitted traffic and the denied traffic. I've been having an issue with my configuration, can someone take a look at it I'm not sure what i am doing wrong.

input {
        udp {
                port => 5514
                type => "cisco-fw"
        }
}

filter {
        if [type] == "cisco-fw" {
                if "%ASA-106023" in [message] {
                        grok {
                                match => [
                                        "message", "%{CISCOFW106023}"
                                ]
                        }
                } else if "%ASA-106100" in [message] {
                        grok {
                                match => [
                                        "message", "%{CISCOFW106100}"
                                ]
                        }
                } else {
                        drop {}
                }
        }
}


output {
        elasticsearch {
                hosts => ["localhost:9200"]
                index => "syslog-%{+YYYY.MM}"
        }
        stdout { codec => rubydebug }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.