Parsing syslogs from different Cisco devices to Logstash

Rinat · February 10, 2017, 3:22pm

My scenario is as follows: rsyslog server collects logs from different Cisco gears. It then forwards it to Logstash as syslogs type.

Are there any configuration examples for Logstash to filter all the different Cisco devices? Any examples of filters/config files?

Running 5.1 on RHEL 6.

magnusbaeck · February 13, 2017, 10:39am

There are a bunch of Cisco patterns bundled with Logstash:

github.com

logstash-plugins/logstash-patterns-core/blob/v4.0.2/patterns/firewalls

# NetScreen firewall logs
NETSCREENSESSIONLOG %{SYSLOGTIMESTAMP:date} %{IPORHOST:device} %{IPORHOST}: NetScreen device_id=%{WORD:device_id}%{DATA}: start_time=%{QUOTEDSTRING:start_time} duration=%{INT:duration} policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:proto} src zone=%{WORD:src_zone} dst zone=%{WORD:dst_zone} action=%{WORD:action} sent=%{INT:sent} rcvd=%{INT:rcvd} src=%{IPORHOST:src_ip} dst=%{IPORHOST:dst_ip} src_port=%{INT:src_port} dst_port=%{INT:dst_port} src-xlated ip=%{IPORHOST:src_xlated_ip} port=%{INT:src_xlated_port} dst-xlated ip=%{IPORHOST:dst_xlated_ip} port=%{INT:dst_xlated_port} session_id=%{INT:session_id} reason=%{GREEDYDATA:reason}

#== Cisco ASA ==
CISCO_TAGGED_SYSLOG ^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})? ?: %%{CISCOTAG:ciscotag}:
CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}
CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9_]+)
# Common Particles
CISCO_ACTION Built|Teardown|Deny|Denied|denied|requested|permitted|denied by ACL|discarded|est-allowed|Dropping|created|deleted
CISCO_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s*)*
CISCO_DIRECTION Inbound|inbound|Outbound|outbound
CISCO_INTERVAL first hit|%{INT}-second interval
CISCO_XLATE_TYPE static|dynamic
# ASA-1-104001
CISCOFW104001 \((?:Primary|Secondary)\) Switching to ACTIVE - %{GREEDYDATA:switch_reason}
# ASA-1-104002
CISCOFW104002 \((?:Primary|Secondary)\) Switching to STANDBY - %{GREEDYDATA:switch_reason}
# ASA-1-104003
CISCOFW104003 \((?:Primary|Secondary)\) Switching to FAILED\.
# ASA-1-104004

This file has been truncated. show original

Rinat · February 13, 2017, 6:41pm

Thanks!

My understanding is that I need to include those lines inside grok filter? How would I go about it?

Best regards,

Rinat

system · March 13, 2017, 6:42pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Logstah filter for cisco device Logstash	1	2010	September 7, 2017
Cisco ASA syslog parsing Elasticsearch	2	3403	April 29, 2019
Cisco Log Processing Logstash	23	20035	May 1, 2017
The definition of grok pattern CISCO_REASON Logstash	3	3425	July 20, 2017
Logstash 2.0.0 and Cisco ASA syslog Logstash	5	4384	July 6, 2017

Parsing syslogs from different Cisco devices to Logstash

Related topics