# The unusual syslog from cisco

**URL:** <https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470>\
**Category:** Logstash\
**Created:** [October 19, 2017, 2:05am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470 "2017-10-19T02:05:40Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 19, 2017, 2:05am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/1 "2017-10-19T02:05:40Z")

</div>

We have some cisco devices , all of them have the same syslog configuration.

The normal format should like:  
\<187\>11640: PH18L1\_CS29SW01: Oct 19 09:11:45.797 GMT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down  
then i can using some pattern to grok that,

but now i can receive some unusual syslog  
it just like as below:  
\<187\>11640: PH18L1\_CS29SW01: ]: Oct 19 09:11:45.797 GMT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down

I don't know why,because all the switches have the same configuration.And until now i can not find any valid pattern to grok the error syslog message, i had tried to use self-defined pattern, but still doesn't work.

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [October 19, 2017, 5:30am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/2 "2017-10-19T05:30:19Z")

</div>

What is your question ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 19, 2017, 5:53am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/3 "2017-10-19T05:53:17Z")

</div>

You can use `(\]: )?` to optionally match an extra square bracket and colon.

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 19, 2017, 6:32am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/4 "2017-10-19T06:32:31Z")

</div>

My question is how can i match the unexpected string " ]",and please notice that there is a space before ].Thanks  
Actually i have tried to use "^\s{1}]$" to match the string , it does work when i using it individually .But the problem is that if i using the grok expression such as %{HOSTNAME}:%{UNP:hahha} （I defined " unp ^\s{1}]$" in my pattern）,it doesn't work !!!

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [October 19, 2017, 6:47am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/5 "2017-10-19T06:47:10Z")

</div>

Ah . I got it.

**HOSTNAME** does not parse _\__.

If you look at the [template](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns),

`HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)`

it parses **-** but not **underscore**.

So , you may want to try a filter like below.

```
filter {
  grok {
    match => { "message" => "\A<%{INT}>%{INT}: (?<hostname>[a-zA-Z0-9_-]+):(\s\]:)? %{GREEDYDATA:greedy}\Z" }
  }
}

```

Parsed correctly for both cases.

```
{
          "path" => "/tmp/sample.file",
      "hostname" => "PH18L1_CS29SW01",
    "@timestamp" => 2017-10-19T06:42:59.845Z,
      "@version" => "1",
          "host" => "localhost.localdomain",
        "greedy" => "Oct 19 09:11:45.797 GMT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down",
       "message" => "<187>11640: PH18L1_CS29SW01: ]: Oct 19 09:11:45.797 GMT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down"
}

{
          "path" => "/tmp/sample.file",
      "hostname" => "PH18L1_CS29SW01",
    "@timestamp" => 2017-10-19T06:46:33.074Z,
      "@version" => "1",
          "host" => "localhost.localdomain",
        "greedy" => "Oct 19 09:11:45.797 GMT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down",
       "message" => "<187>11640: PH18L1_CS29SW01: Oct 19 09:11:45.797 GMT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down"
}
```

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 19, 2017, 7:42am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/6 "2017-10-19T07:42:18Z")

</div>

Wow it does work,but i find something interesting , i tried to replace it by ”(^\s+]$)?“  
It does work , but i can not find the string that i've defined , such as

filter {  
grok {  
patterns\_dir =\> ["/usr/share/logstash/pattern"]  
match =\> { "message" =\> "%{SYSLOGHOST:origin\_hostname}:%{TEST1:anod}" }

then i put in "PH18L1-CS29SW01: ]",the output just like

PH18L1-CS29SW01: ]  
{  
"@version" =\> "1",  
"host" =\> "logstash",  
"@timestamp" =\> 2017-10-19T07:25:45.658Z,  
"message" =\> "PH18L1-CS29SW01: ]",  
"origin\_hostname" =\> "PH18L1-CS29SW01",  
"tags" =\> [  
[0] "\_geoip\_lookup\_failure"  
]  
}

But where is my anod ? hha

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 19, 2017, 7:43am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/7 "2017-10-19T07:43:27Z")

</div>

Wow it does work,but i find something interesting , i tried to replace it by ”(^\s+]$)?“  
It does work , but i can not find the string that i've defined , such as

filter {  
grok {  
patterns\_dir =\> ["/usr/share/logstash/pattern"]  
match =\> { "message" =\> "%{SYSLOGHOST:origin\_hostname}:%{TEST1:anod}" }

then i put in "PH18L1-CS29SW01: ]",the output just like

PH18L1-CS29SW01: ]  
{  
"@version" =\> "1",  
"host" =\> "logstash",  
"@timestamp" =\> 2017-10-19T07:25:45.658Z,  
"message" =\> "PH18L1-CS29SW01: ]",  
"origin\_hostname" =\> "PH18L1-CS29SW01",  
"tags" =\> [  
[0] "\_geoip\_lookup\_failure"  
]  
}

But where is my anod ? hha

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [October 19, 2017, 7:48am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/8 "2017-10-19T07:48:23Z")

</div>

Take off **^**.

It means the beginning of the line .

> <https://github.com/kkos/oniguruma/blob/master/doc/RE>

> 1. Anchors
> 
> ^ beginning of the line

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 19, 2017, 7:50am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/9 "2017-10-19T07:50:25Z")

</div>

Thank you so much , i am a totally newcomer in logstash,it's been a big help

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [October 19, 2017, 7:54am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/10 "2017-10-19T07:54:06Z")

</div>

Glad that it worked out!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2017, 7:54am UTC](https://discuss.elastic.co/t/the-unusual-syslog-from-cisco/104470/11 "2017-11-16T07:54:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.