Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Parsing IOS & XR syslogs
input {
udp {
port => 514
type => "syslog"
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => [
# IOS-XR 6.x.x
"<%{INT:priority}>%{NUMBER:seq#}: %{DATA:node}:%{CISCOTIMESTAMP:log_date} : %{DATA:process}\[%{INT:pid}\]: %%{WORD:category}-%{WORD:group}-%{INT:severity}-%{WORD:mnemonic} : %{GREEDYDATA:message}",
# IOS
"<%{INT:priority}>%{NUMBER:seq#}: \*%{CISCOTIMESTAMP:log_date}: %%{WORD:category}-%{INT:severity}-%{WORD:mnemonic}: %{GREEDYDATA:message}" ]
}
overwrite => [ "message" ]
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment