-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
While the IOS and ASA sources are not sharing a code base there is overlap in some variations of the format. The Cisco IOS parser will now be the cisco_syslog parser and ASA and IOS can share
- Loading branch information
rfaircloth-splunk
committed
Mar 12, 2020
1 parent
3f40892
commit aec103f
Showing
8 changed files
with
72 additions
and
79 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| filter f_cisco_syslog{ | ||
| match("cisco_syslog", value("fields.sc4s_vendor_product") type(glob)); | ||
| }; | ||
| rewrite set_cisco_syslog{ | ||
| set("cisco_syslog" value("fields.sc4s_syslog_format")); | ||
| }; | ||
| filter f_is_cisco_syslog{ | ||
| match("cisco_syslog" value("fields.sc4s_syslog_format")) | ||
| }; | ||
|
|
||
| parser cisco-parser-ex{ | ||
| channel { | ||
| filter { | ||
| #message('^<\d*> ?(?:(\d+)\: )?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(\d+): )?(?:(\d\d:\d\d:\d\d|\d{1,6} \d{1,2}))?(?:(\*)?((?:\w\w\w {1,2}\d{1,2} (?:\d{2,4} )?\d\d:\d\d:\d\d)(?:\.\d{3,6})?( [AP]M)?)( [A-Z]{3,3})?)?( \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} )?: ((\%[^\: ]+)\:? ?.*)' flags(store-matches)); | ||
| message('^^<\d*> ?(?:(\d+)\: )?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(\d+): )?(?:(\d\d:\d\d:\d\d|\d{1,6} \d{1,2}))?(?:(\*)?((?:\w\w\w {1,2}\d{1,2} (?:\d{2,4} )?\d\d:\d\d:\d\d)(?:\.\d{3,6})?( [AP]M)?)( [A-Z]{3,3})?)? ?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))? ?: ((\%[^\: ]+)\:? ?.*)' flags(store-matches)); | ||
| }; | ||
| if { | ||
| #Mar 4 11:45:20 | ||
| #Apr 29 13:58:46.000001 | ||
| #Apr 29 13:58:46.411 | ||
| #Mar 1 18:48:50.483 UTC NOTE: Reverse TZ "%Z" parsing will not work for non-local timezones. | ||
| # guess-timezone() will be used to reconcile timezones | ||
| parser { | ||
| date-parser(format( | ||
| '%b %d %H:%M:%S.%f', | ||
| '%b %d %H:%M:%S', | ||
| '%b %d %I:%M:%S %p.%f', | ||
| '%b %d %I:%M:%S %p', | ||
| '%b %d %Y %H:%M:%S.%f' | ||
| '%b %d %Y %H:%M:%S', | ||
| ) | ||
| template("$8") | ||
| flags(guess-timezone) | ||
| ); | ||
| }; | ||
| } else { | ||
| # rewrite { set("date/time parser failed", value("fields.sc4s_error")); }; | ||
| rewrite { set("date/time parser failed on string $8" value("fields.sc4s_error")); }; | ||
| }; | ||
| rewrite { | ||
| set( | ||
| "${4}", | ||
| value("HOST") | ||
| condition(match('..' value('4'))) | ||
| ); | ||
| set( | ||
| "${13}", | ||
| value("HOST") | ||
| condition(match('..' value('13'))) | ||
| ); | ||
| set( | ||
| "${15}", | ||
| value("PROGRAM") | ||
| ); | ||
| set( | ||
| "${14}", | ||
| value("MESSAGE") | ||
| ); | ||
| }; | ||
|
|
||
| }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,54 +1,3 @@ | ||
| # In general this will not be used; parser setting will override the need for this | ||
|
|
||
| filter f_cisco_ios{ | ||
| match("cisco_ios", value("fields.sc4s_vendor_product") type(glob)); | ||
| }; | ||
|
|
||
|
|
||
| parser cisco-parser-ex{ | ||
| channel { | ||
| filter { | ||
| #message('^<\d*>(?:(?<ciscoseq>\d+)\: )?(?:(?<HOST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(?<ciscorule>\d+): )?(?:(?<ciscotimereliable>\*)?(?<ciscotime>(?<time>\w\w\w {1,2}\d{1,2} \d\d:\d\d:\d\d)(?<ciscofrac>\.\d{3,6})? ?(?<ciscotz>\w+)?): )?(?:(?<ciscouptime>\d\d:\d\d:\d\d|\d{1,6} \d{1,2}): )?(?<cisomsg>(?<ciscoprogram>%.{2,15}\-\d{1,3}\-[^:]{3,}): (?<ciscodescription>.*))' flags(store-matches)); | ||
| message('^<\d*>(?:(\d+)\: )?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(\d+): )?(?:(\*)?((?:\w\w\w {1,2}\d{1,2} (?:\d{2,4} )?\d\d:\d\d:\d\d)(?:\.\d{3,6})?( [AP]M)?)( \w+)?: )?(?:(\d\d:\d\d:\d\d|\d{1,6} \d{1,2}): )?(%.{2,15}\-\d{1,3}\-[^:]+): (.*)' flags(store-matches)); | ||
| }; | ||
| if { | ||
| #Mar 4 11:45:20 | ||
| #Apr 29 13:58:46.000001 | ||
| #Apr 29 13:58:46.411 | ||
| #Mar 1 18:48:50.483 UTC NOTE: Reverse TZ "%Z" parsing will not work for non-local timezones. | ||
| # guess-timezone() will be used to reconcile timezones | ||
| parser { | ||
| date-parser(format( | ||
| '%b %d %H:%M:%S.%f', | ||
| '%b %d %H:%M:%S', | ||
| '%b %d %I:%M:%S %p.%f', | ||
| '%b %d %I:%M:%S %p', | ||
| '%b %d %Y %H:%M:%S.%f' | ||
| '%b %d %Y %H:%M:%S', | ||
| ) | ||
| template("$7") | ||
| flags(guess-timezone) | ||
| ); | ||
| }; | ||
| } else { | ||
| # rewrite { set("date/time parser failed", value("fields.sc4s_error")); }; | ||
| rewrite { set("date/time parser failed on string $7" value("fields.sc4s_error")); }; | ||
| }; | ||
| rewrite { | ||
| set( | ||
| "$4", | ||
| value("HOST") | ||
| condition(match('..' value('4'))) | ||
| ); | ||
| set( | ||
| "$11", | ||
| value("PROGRAM") | ||
| ); | ||
| set( | ||
| "$12", | ||
| value("MSG") | ||
| ); | ||
| }; | ||
|
|
||
| }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters