how would you parse this message?
Aug 15 2018 10:46:33: %ASA-6-302014: Teardown TCP connection 1576899401 for outside:10.3.128.40/55258(LOCAL\james.smith) to inside:10.10.1.10/80 duration 0:03:15 bytes 916787 TCP Reset-I (james.smith)
because i have to brake everything into small thing. with grok extractors it’s easy, but with rule for pipelines doesn’t work…
for this one here is what i have as a grok extractor:
%{CISCO_ACTION:action}(?: %{CISCO_DIRECTION:direction})? %{WORD:protocol} connection %{INT:connection_id} for %{DATA:src_interface}:%{IPV4:src_ip}/%{INT:src_port}( (%{IPV4:src_mapped_ip}/%{INT:src_mapped_port}))?((%{DATA:src_fwuser}))? to %{DATA:dst_interface}:%{IPV4:dst_ip}/%{INT:dst_port}( (%{IPV4:dst_mapped_ip}/%{INT:dst_mapped_port}))?((%{DATA:dst_fwuser}))?( duration %{TIME:duration} bytes %{INT:bytes})?(?: %{CISCO_REASON:reason})?( (%{DATA:user}))?
can you figure out how can i have the same result with a rule for a pipeline?