# Split multiple CGN Logs from Cisco Router to separate Documents

**URL:** <https://discuss.elastic.co/t/split-multiple-cgn-logs-from-cisco-router-to-separate-documents/143809>\
**Category:** Logstash\
**Created:** [August 10, 2018, 6:50am UTC](https://discuss.elastic.co/t/split-multiple-cgn-logs-from-cisco-router-to-separate-documents/143809 "2018-08-10T06:50:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![neerajsapkota](https://avatars.discourse-cdn.com/v4/letter/n/7feea3/32.png) [@neerajsapkota](https://discuss.elastic.co/u/neerajsapkota)\
**Post date:** [August 10, 2018, 6:50am UTC](https://discuss.elastic.co/t/split-multiple-cgn-logs-from-cisco-router-to-separate-documents/143809/1 "2018-08-10T06:50:23Z")

</div>

Here is the syslog message from Cisco Router..  
I get this output in Kibana Discover tab in message field.

\<134\> 1 2018 Aug 10 05:48:17 - - NAT44 - [SessionbasedWD 17 10.10.10.2 poolA - 192.168.1.2 40945 41011 - 172.16.1.2 53][SessionbasedWD 6 10.10.10.5 poolA - 192.168.1.2 43752 6182 - 172.16.1.5 443][SessionbasedWD 17 10.10.10.16 poolA - 192.168.1.3 47766 33538 - 172.16.1.10 8615][SessionbasedWD 6 10.10.10.17 poolA - 192.168.1.3 2803 7171 - 172.16.1.15 80][SessionbasedWD 6 10.10.10.19 poolA - 192.168.1.3 15523 53551 - 172.16.1.54 443][SessionbasedWD 17 10.10.10.10 poolA - 192.168.1.2 14907 24773 - 172.16.1.38 53][SessionbasedAD 17 10.10.10.11 poolA - 192.168.1.5 45145 26295 - 172.16.1.26 53][SessionbasedAD 17 10.10.10.24 poolA - 192.168.1.10 45145 26295 - 172.16.1.87 53][SessionbasedWD 17 10.10.10.222 poolA - 192.168.1.30 51503 32237 - 172.16.1.90 53]

I have used this grok filter to parse the log:

message : match =\> { "message" =\> "\s1\s%{NUMBER:year}\s%{WORD:month}\s%{NUMBER:day}\s%{TIME:time}\s\s-\s-\s%{WORD:CGN\_type}\s-\s[%{WORD:session\_type}\s%{NUMBER:protocol}\s%{IP:src\_ip\_private}\s%{WORD:inside\_vrf}\s-\s%{IP:src\_ip\_public\_translated}\s%{NUMBER:src\_port}\s%{NUMBER:src\_port\_translated}\s-\s%{IP:dst\_ip}\s%{NUMBER:dst\_port}\s]" }

Grok parses the syslog successfully but only the first occurrence is matched and rest of the information is supressed.

Now, I need to Split the syslog into separate documents so that the message field in each document is as follows:

document1: \<134\> 1 2018 Aug 10 05:48:17 - - NAT44 - [SessionbasedWD 17 10.10.10.2 poolA - 192.168.1.2 40945 41011 - 172.16.1.2 53]

document2: \<134\> 1 2018 Aug 10 05:48:17 - - NAT44 - [SessionbasedWD 6 10.10.10.5 poolA - 192.168.1.2 43752 6182 - 172.16.1.5 443]

document3: \<134\> 1 2018 Aug 10 05:48:17 - - NAT44 - [SessionbasedWD 17 10.10.10.16 poolA - 192.168.1.3 47766 33538 - 172.16.1.10 8615]

and so on.

Any help will be Appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 10, 2018, 9:24am UTC](https://discuss.elastic.co/t/split-multiple-cgn-logs-from-cisco-router-to-separate-documents/143809/2 "2018-08-10T09:24:15Z")

</div>

You'll want to create an array with all the `[SessionbasedWD ...]` strings, i.e. your event should look something like

```nohighlight
{
  "@timestamp": ...,
  "entries": [
    "[SessionbasedWD 17 10.10.10.2 poolA - 192.168.1.2 40945 41011 - 172.16.1.2 53]",
    "[SessionbasedWD 6 10.10.10.5 poolA - 192.168.1.2 43752 6182 - 172.16.1.5 443]",
    "[SessionbasedWD 17 10.10.10.16 poolA - 192.168.1.3 47766 33538 - 172.16.1.10 8615]",
    "[SessionbasedWD 6 10.10.10.17 poolA - 192.168.1.3 2803 7171 - 172.16.1.15 80]",
    ...
  ],
  ...
}

```

and then you use a split filter on that array field. I think you'll be able to apply further filtering (like grok) on the resulting events. To create the array you should be able to use a mutate filter and its split option (not to be confused with the split _filter_) and split the string on `][`.

---

<div class="post-metadata">

**Author:** ![neerajsapkota](https://avatars.discourse-cdn.com/v4/letter/n/7feea3/32.png) [@neerajsapkota](https://discuss.elastic.co/u/neerajsapkota)\
**Post date:** [August 12, 2018, 5:54am UTC](https://discuss.elastic.co/t/split-multiple-cgn-logs-from-cisco-router-to-separate-documents/143809/3 "2018-08-12T05:54:07Z")

</div>

Thanks a lot @magnusbaeck . I got it working with the config below:

```
input {
   udp {
    port => 5544
        type => "syslog"
        }
      }

filter {
  if [type] == "syslog" {
    grok {
match => { "message" => "(?<info>[^\[]*)(?<patterns>[^\$]*)" }
remove_field => ["message"] 
    }
mutate {
        split => { "patterns" => "]["}
    }
 split{
        field => "patterns"
    }
  }
}

output {
if [type] == "syslog" {
  elasticsearch {
    hosts => ["localhost:9200"]
                }
}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2018, 6:05am UTC](https://discuss.elastic.co/t/split-multiple-cgn-logs-from-cisco-router-to-separate-documents/143809/4 "2018-09-09T06:05:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.