Unable to parse Meraki MX

Frank_Shearer · November 14, 2018, 4:52pm

Hi All,

I'm having an issue maybe someone can help me out with, I am trying to parse Meraki flows messages which look like this:

gist.github.com

https://gist.github.com/bboy8012/0322db5d28ad883c7307d5e76367163e

MX flows

<134>1 1542054623.620528045 WA_KIR_MX65W flows src=10.130.1.84 dst=10.158.27.1 protocol=udp sport=54873 dport=161 pattern: allow all
<134>1 1542054626.601322601 WA_KIR_MX65W flows src=10.130.1.84 dst=10.158.27.5 protocol=udp sport=56930 dport=161 pattern: allow all
<134>1 1542054649.514505350 WA_KIR_MX65W flows src=10.130.1.84 dst=10.158.27.5 protocol=udp sport=65303 dport=161 pattern: allow all
<134>1 1542054649.495042529 WA_KIR_MX65W flows src=10.130.1.84 dst=10.158.27.5 protocol=udp sport=65305 dport=161 pattern: allow all
<134>1 1542054657.813423746 WA_KIR_MX65W flows src=10.130.1.84 dst=10.158.27.1 protocol=udp sport=60730 dport=161 pattern: allow all

my input conf is this:

gist.github.com

https://gist.github.com/bboy8012/a8fb1ef1b5bb161f6009fc4ee15cda89

01-input-syslog.conf

input {
  udp {
    port => 1514
    tags => [ "Cisco_IOS" ]
  }
  udp {
    port => 2514
    tags => [ "Meraki" ]
    #type => "syslog"
  }

This file has been truncated. show original

and my filter conf is this:

gist.github.com

https://gist.github.com/bboy8012/33552388254c087238dbc70017e3d283

40-filter-meraki.conf

filter {
    if "Meraki" in [tags] {
        if [log_type] == "flows" {
            grok {
                match => ["message", "%{SYSLOGPROG} %{BASE10NUM:epoch_time} %{WORD:device} %{WORD:log_event_type} (src=)%{IP:src_ip} (dst=)%{IP:dst_ip} (protocol=)%{WORD:proto} (sport=)%{POSINT:sport} (dport=)%{POSINT:dport} (pattern: )%{WORD:allowed} %{WORD}",
                          "message", "%{SYSLOGPROG} %{BASE10NUM:epoch_time} %{WORD:device} %{WORD:log_event_type} (src=)%{IP:src_ip} (dst=)%{IP:dst_ip} (protocol=)%{WORD:proto} (type=)%{POSINT:tport} (pattern: )%{WORD:allowed} %{WORD}"
                ]

                remove_field => [ "syslog5424_pri", "@version" ]
            }#end [log_type] == flows grok

This file has been truncated. show original

I continually get this in stdout when testing and I have verified the gork works using grokconstructor.

gist.github.com

https://gist.github.com/bboy8012/a4a797f77572e9d81ef408b631c89344

output after meraki filter

{
         "@timestamp" => 2018-11-14T16:50:01.080Z,
               "tags" => [
        [0] "Meraki",
        [1] "cisco-meraki"
    ],
            "message" => "<134>1 1542214201.058368310 XX_XXX_MX65W flows src=10.130.1.84 dst=10.158.27.1 protocol=udp sport=58110 dport=161 pattern: allow all",
               "host" => "10.209.27.1",
           "@version" => "1",
    "parsing_problem" => "unfamiliar cisco-meraki log_type."

This file has been truncated. show original

Can someone tell me what I am doing wrong? Thanks

Frank_Shearer · November 15, 2018, 6:37pm

I figured it out, all I did was move everything inside the filter statement and did the logic from there. Thanks

system · December 13, 2018, 6:48pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.