Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
A Logstash grok filter for yamaha router syslog.
# URL FILTER
filter{
grok {
match => ["message", "%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec}:\s\[NAT\(%{INT:natvalue}\):PP%{INT:pp}\]\s%{WORD:status}\s%{WORD:tcpudp}\s%{IP:global_ip}.%{INT:global_port}\s<->\s%{IP:from_ip}.%{INT:from_port}\s==>\s%{IP:conn_ip}.%{INT:conn_port}",
"message", "%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec}:\s\[%{WORD:status}\]\sPP\[%{INT:pp}\]\[%{WORD:inout}\]\[%{INT:filter}\]\s%{WORD:tcpudp}\s%{IP:from_ip}:%{INT:from_port}\s>\s%{IP:conn_ip}:%{INT:conn_port}\s\(%{YEAR:conn_year}/%{MONTHNUM:conn_month}/%{MONTHDAY:conn_day} %{HOUR:conn_hour}:%{MINUTE:conn_min}:%{SECOND:conn_sec}\)",
"message", "%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec}:\sPP\[%{INT:pp}\]\s%{WORD:status}\sat\s%{WORD:inout}\(%{WORD:filter}\)\sfilter:\s%{WORD:tcpudp}\s%{IP:from_ip}:%{INT:from_port}\s>\s%{IP:conn_ip}:%{INT:conn_port}"
]
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.