Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Processing ASA logs in LogStash after having passed through rsyslog, with thanks to PinkFreud on IRC in the #logstash channel on FreeNode
input {
tcp {
port => 5000
type => syslog
}
udp {
port => 5000
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?:? %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{@source_host}" ]
}
syslog_pri {
}
if [syslog_program] =~ "%ASA-\d+-\d+" {
grok {
match => [
"syslog_message", "%{CISCOFW106001}",
"syslog_message", "%{CISCOFW106006_106007_106010}",
"syslog_message", "%{CISCOFW106014}",
"syslog_message", "%{CISCOFW106015}",
"syslog_message", "%{CISCOFW106021}",
"syslog_message", "%{CISCOFW106023}",
"syslog_message", "%{CISCOFW106100}",
"syslog_message", "%{CISCOFW110002}",
"syslog_message", "%{CISCOFW302010}",
"syslog_message", "%{CISCOFW302013_302014_302015_302016}",
"syslog_message", "%{CISCOFW302020_302021}",
"syslog_message", "%{CISCOFW305011}",
"syslog_message", "%{CISCOFW313001_313004_313008}",
"syslog_message", "%{CISCOFW313005}",
"syslog_message", "%{CISCOFW402117}",
"syslog_message", "%{CISCOFW402119}",
"syslog_message", "%{CISCOFW419001}",
"syslog_message", "%{CISCOFW419002}",
"syslog_message", "%{CISCOFW500004}",
"syslog_message", "%{CISCOFW602303_602304}",
"syslog_message", "%{CISCOFW710001_710002_710003_710005_710006}",
"syslog_message", "%{CISCOFW713172}",
"syslog_message", "%{CISCOFW733100}"
]
tag_on_failure => ["_ciscoparsefailure"]
}
}
date {
match => ["timestamp",
"MMM dd HH:mm:ss",
"MMM d HH:mm:ss",
"MMM dd yyyy HH:mm:ss",
"MMM d yyyy HH:mm:ss"
]
}
if !("_grokparsefailure" in [tags]) {
mutate {
replace => [ "host", "%{syslog_hostname}" ]
replace => [ "message", "%{syslog_message}" ]
}
}
mutate {
replace => [ "host", "%{syslog_hostname}" ]
replace => [ "message", "%{syslog_message}" ]
}
}
}
output {
# Example just to output to elasticsearch
elasticsearch { embedded => false }
stdout { }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment