# Syslog filters for Versa Networks **URL:** \ **Category:** Logstash\ **Created:** [November 9, 2018, 10:28pm UTC](https://discuss.elastic.co/t/syslog-filters-for-versa-networks/156113 "2018-11-09T22:28:09Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Zorkmid](https://avatars.discourse-cdn.com/v4/letter/z/e68b1a/32.png) [@Zorkmid](https://discuss.elastic.co/u/Zorkmid)\ **Post date:** [November 9, 2018, 10:28pm UTC](https://discuss.elastic.co/t/syslog-filters-for-versa-networks/156113/1 "2018-11-09T22:28:09Z")
Hello, Has any one work with Syslog output from Versa Network's SD-WAND products? I'm working on a POC with Versa and would like to see the output from the SD-WAN devices be ingested into ES via logstash. The following are sample out puts from the Versa SD-WAN products **Flow Identification Log** 2017-11-26T22:42:37+0000 flowIdLog, _applianceName=Branch1, tenantName=Customer1, flowId=33655871, flowCookie=1511734794_ , sourceIPv4Address=172.21.1.2, destinationIPv4Address=172.21.2.2, sourcePort=44657, destinationPort=5001, tenantId=1, vsnId=0, applianceId=1, ingressInterfaceName=vni-0/2.0, egressInterfaceName=ptvi-0/43, fromCountry=, toCountry=, protocolIdentifier=6, fromZone=trust, fromUser=unknown, toZone=ptvi, icmpTypeIPv4=0 **SDWAN Traffic Monitoring Log** 2017-11-26T22:42:38+0000 flowMonLog, _applianceName=Branch1, tenantName=Customer1, flowId=33655871, flowCookie=1511734794,_ flowStartMilliseconds=361020099, flowEndMilliseconds=361865221, sentOctets=15000, sentPackets=34, recvdOctets=360, recvdPackets=6, vsnId=0, applianceId=1, tenantId=1, appRisk=1, appProductivity=3, appIdStr=iperf, appFamily=, appSubFamily=, urlCategory=, rule=catchall, localSiteName=Branch1, fwdEgrSiteName=Branch2, fwdEgrAccCktName=MPLS:MPLS, revIngAccCktName=MPLS, revIngSiteName=, fwdIngSiteName=, fwdIngAccCktName=vni-0/2.0, revEgrSiteName=, revEgrAccCktName=vni-0/2.0 **SDWAN SLA Violation Log** 2017-11-28T23:12:43+0000 sdwanSlaPathViolLog _, applianceName=Site1Branch1, tenantName=Customer1, flowId=33655871, flowCookie=1511734794,_ applianceId=1, tenantId=1, vsnId=0, rule=Rule\_Http, localSiteName=Site1Branch1, fromRemoteSiteName=, fromLocalAccCktName=, fromRemoteAccCktName=, toRemoteSiteName=Site3Branch1, toLocalAccCktName=ISPA-Network, toRemoteAccCktName=ISPA-Network, forwardingClass=fc\_be, fromPriority=P-0, toPriority=SLA Vio, reason="Violating metrics [Current value(Configured Threshold)]: latency-714(250) loss percentage-12.50(5) " **CGNAT Log** 2017-11-26T22:36:31+0000 cgnatLog, _applianceName=Site1Branch1, tenantName=Customer1_ , observationTimeMilliseconds=2337165310, _flowId=33655871, flowCookie=1511734794_ , sourceIPv4Address=172.18.101.10, destinationIPv4Address=8.8.8.8, postNATSourceIPv4Address=70.70.5.2, postNATDestinationIPv4Address=8.8.8.8, sourcePort=37190, destinationPort=53, postNAPTsourceTransportPort=45643, postNAPTdestinationTransportPort=53, tenantId=1, vsnId=0, applianceId=0, protocolIdentifier=17, sourceNatPoolName=DIA-Pool-ISPA-Network, destNatPoolName=-, natRuleName=DIA-Rule-Customer1-LAN1-VR-ISPA-Network, natEvent=nat44-sess-create **Firewall Access Log** 2017-11-26T22:42:38+0000 accessLog, _applianceName=Branch1, tenantName=Customer1, flowId=33655871, flowCookie=1511734794,_ flowStartMilliseconds=361020099, flowEndMilliseconds=361865221, sentOctets=15000, sentPackets=34, recvdOctets=360, recvdPackets=6, appId=245, eventType=end, tenantId=1, urlCategory=, action=allow, vsnId=0, applianceId=1, appRisk=1, appProductivity=3, appIdStr=iperf, appFamily=networking, appSubFamily=network-management, rule=r1, forwardForwardingClass=fc\_be, reverseForwardingClass=fc\_be, host= **Anti-Virus Log** 2017-11-28T22:52:54+0000 avLog, _applianceName=Site1Branch1, tenantName=Customer1, flowId=33655871, flowCookie=1511734794_ , vsnId=0, applianceId=1, tenantId=1, profileName=scan\_http, appIdStr=http, fileName="1", fileType=Portable Document File, fileTransDir=download, avMalwareType=AV\_DETECTION\_TYPE\_VIRUS, avMalwareName=W32/ExploreZip.210432, avAccuracy=AV\_DETECTION\_ACCURACY\_LOW, avAction=reject **IDP Log** 2017-11-26T22:37:11+0000 idpLog, _applianceName=Branch1, tenantName=Customer1, flowId=33655871, flowCookie=1511734794,_ signatureId=1000000530, groupId=1, signatureRev=0, vsnId=0, applianceId=1, tenantId=1, moduleId=12, signaturePriority=2, idpAction=alert, signatureMsg="Microsoft DNS Server Denial of Service", classMsg="Attempted Denial of Service", threatType=attempted-dos, packetTime=11/26/2017-14:37:11.000000, HitCount=1, ipsProfile=Vulnerablity\_Profile, ipsProfileRule=Rule1, ipsDirection=ToClient, ipsProtocol=UDP, ipsApplication=dns **URL Filtering Log** 2017-11-26T24:42:38+0000 urlfLog, _applianceName=DC1Branch1, tenantName=Customer1, flowId=33655871, flowCookie=1511734794_ , vsnId=0, applianceId=1, tenantId=1, urlReputation=trustworthy, urlCategory=business\_and\_economy, httpUrl=[apt.puppetlabs.com/dists/trusty/Release.gpg](http://apt.puppetlabs.com/dists/trusty/Release.gpg), urlfProfile=url\_profile1, urlfAction=ask, urlfActionMessage= Thanks TimW ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2018, 10:28pm UTC](https://discuss.elastic.co/t/syslog-filters-for-versa-networks/156113/2 "2018-12-07T22:28:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.