6018-cisco_asa.conf

# SOF-ELK® Configuration File
# (C)2016 Lewes Technology Consulting, LLC
#
# This file contains filters, transforms, and enrichments for Cisco ASA messages

filter {
  if [type] == "syslog" and !("parse_done" in [tags]) {
    # Cisco ASA messages
    grok {
      patterns_dir => [ "/usr/local/sof-elk/grok-patterns" ]
      match => [ "message", "%{CISCO_ASA_MSG}" ]
      add_tag => [ "got_cisco", "parse_done" ]
      tag_on_failure => [ "_defaultparse" ]
    }
  }
}