title: Groking Cisco switches with Logstash
body: <p>I'm setting up Logstash (ELK) as our central logging server and so far have had good luck with simple filters, but this latest one for our switches isn't coming as easily. Here's what a typical line looks like:</p>
  
  <pre><code>&lt;179&gt;12600: [syslog@9 s_id =\"SWITCH1:5143\"]: &lt;ios-log-msg&gt;&lt;facility&gt;LINK&lt;/facility&gt;&lt;severity&gt;3&lt;/severity&gt;&lt;msg-id&gt;UPDOWN&lt;/msg-id&gt;&lt;time&gt;Jul 15 09:03:04&lt;/time&gt;&lt;args&gt;&lt;arg id=\"0\"&gt;GigabitEthernet1/0/32&lt;/arg&gt;&lt;arg id=\"1\"&gt;up&lt;/arg&gt;&lt;/args&gt;&lt;/ios-log-msg&gt;
  </code></pre>
  
  <p>Here's one of the patterns I'm working on:</p>
  
  <pre><code>&lt;%{NUMBER:message_type_id}&gt;%{NUMBER:internal_id}: %{GREEDYDATA} s_id=(?:.{2})%{HOSTNAME:hostname}:5143(?:.{3}): &lt;ios-log-msg&gt;&lt;facility&gt;%{WORD:facility}&lt;/facility&gt;&lt;severity&gt;%{NUMBER:severity}&lt;/severity&gt;&lt;msg-id&gt;%{WORD:message_type}&lt;/msg-id&gt;&lt;time&gt;%{SYSLOGTIMESTAMP:message_timestamp}&lt;/time&gt;&lt;args&gt;&lt;arg id=\"0\"&gt;%{DATA:arg_0}&lt;/arg&gt;&lt;arg id=\"1\"&gt;%{DATA:arg_1}&lt;/arg&gt;&lt;/args&gt;&lt;/ios-log-msg&gt;
  </code></pre>
  
  <p>There's two key issues that I'm hung up on:</p>
  
  <ol>
  <li>The [syslog@9 s_id =\"<strong>BRD-STACK</strong>:5143\"] section contains the hostname of the switch. Everything else is static information and I want to discard (non-bold).</li>
  <li>Towards the end of the entry the "args" section can have a variable number of "arg" elements. This one has 2, and I've seen 1 and 3 as well depending on the message. I need the information contained in each of those.</li>
  </ol>
  
  <p>Any ideas?</p>
  
  <p>For what it's worth, here's the entire filter I was last playing with:</p>
  
  <pre><code>        grok {
          match =&gt; [
              "message", "&lt;%{NUMBER:message_type_id}&gt;%{NUMBER:internal_id}: %{GREEDYDATA} s_id=(?:.{2})%{HOSTNAME:hostname}:5143(?:.{3}): &lt;ios-log-msg&gt;&lt;facility&gt;%{WORD:facility}&lt;/facility&gt;&lt;severity&gt;%{NUMBER:severity}&lt;/severity&gt;&lt;msg-id&gt;%{WORD:message_type}&lt;/msg-id&gt;&lt;time&gt;%{SYSLOGTIMESTAMP:message_timestamp}&lt;/time&gt;&lt;args&gt;&lt;arg id=\"0\"&gt;%{DATA:arg_0}&lt;/arg&gt;&lt;arg id=\"1\"&gt;%{DATA:arg_1}&lt;/arg&gt;&lt;arg id=\"2\"&gt;%{DATA:arg_2}&lt;/arg&gt;&lt;/args&gt;&lt;/ios-log-msg&gt;",
              "message", "&lt;%{NUMBER:message_type_id}&gt;%{NUMBER:internal_id}: %{GREEDYDATA} s_id=(?:.{2})%{HOSTNAME:hostname}:5143(?:.{3}): &lt;ios-log-msg&gt;&lt;facility&gt;%{WORD:facility}&lt;/facility&gt;&lt;severity&gt;%{NUMBER:severity}&lt;/severity&gt;&lt;msg-id&gt;%{WORD:message_type}&lt;/msg-id&gt;&lt;time&gt;%{SYSLOGTIMESTAMP:message_timestamp}&lt;/time&gt;&lt;args&gt;&lt;arg id=\"0\"&gt;%{DATA:arg_0}&lt;/arg&gt;&lt;arg id=\"1\"&gt;%{DATA:arg_1}&lt;/arg&gt;&lt;/args&gt;&lt;/ios-log-msg&gt;",
              "message", "&lt;%{NUMBER:message_type_id}&gt;%{NUMBER:internal_id}: %{GREEDYDATA} s_id=(?:.{2})%{HOSTNAME:hostname}:5143(?:.{3}): &lt;ios-log-msg&gt;&lt;facility&gt;%{WORD:facility}&lt;/facility&gt;&lt;severity&gt;%{NUMBER:severity}&lt;/severity&gt;&lt;msg-id&gt;%{WORD:message_type}&lt;/msg-id&gt;&lt;time&gt;%{SYSLOGTIMESTAMP:message_timestamp}&lt;/time&gt;&lt;args&gt;&lt;arg id=\"0\"&gt;%{DATA:arg_0}&lt;/arg&gt;&lt;/args&gt;&lt;/ios-log-msg&gt;",
              "message", "&lt;%{NUMBER:message_type_id}&gt;%{NUMBER:internal_id}: %{GREEDYDATA} s_id=(?:.{2})%{HOSTNAME:hostname}:5143(?:.{3}): &lt;ios-log-msg&gt;&lt;facility&gt;%{WORD:facility}&lt;/facility&gt;&lt;severity&gt;%{NUMBER:severity}&lt;/severity&gt;&lt;msg-id&gt;%{WORD:message_type}&lt;/msg-id&gt;&lt;time&gt;%{SYSLOGTIMESTAMP:message_timestamp}&lt;/time&gt;&lt;args&gt;%{DATA:args}&lt;/args&gt;&lt;/ios-log-msg&gt;"
          ]
      }
  </code></pre>