1

Have cisco router logs as following 

Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to 2405:XXX:201:XXX:172:22:XXX:25(15616) (RST) tableid - 0

I want key value pair for each log using syslog ng as:

"@timestamp": "Sep 18 20:55:30",
  "host": "2405:XXX:204:XXX:172:22:XXX:25",
  "seq_no1": "93596",
  "seq_no2": "093382",
  "@timestamp1": "Sep 18 20:53:17.848",
  "protocol": "TCP"
  "severity": "6"
  "message": "BADAUTH",
  "msg": "575387: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to 2405:XXX:201:XXX:172:22:XXX:25(15616) (RST) tableid - 0"

Require help for matching regex using this pattern in my syslog-ng.conf file.

destination d_cisco{
  file("/var/log/cisco/all_syslog_in_json.log"perm(0666)template("{\"@timestamp\": \"$ISODATE\", \"host\": \"$HOST\", \"seq_no1\": \"$SEQNUM\", \"seq_no2\": \"$SEQNUM\", \"@timestamp1\": \"$ISODATE\", \"protocol-severity-message\": \"$FAC-SEV-MNEMONIC\", \"message\": \"$MSG\"}\n"));
};
user436054
  • 11
  • 1
  • Maybe it could help : https://serverfault.com/questions/730924/how-to-write-logs-in-json-format ? (the solution provided by the OP) – krisFR Sep 18 '17 at 17:24
  • Hi, you can also try to use the cisco parser that's available in newer syslog-ng versions (3.11) – Robert Fekete Sep 19 '17 at 07:19

0 Answers0