ASA syslog plugin for syslog parsing

(Jan Doberstein) #21

he @mariusgeonea

please use a proper formatting in your postings:

This will make everything more readable.

rule "ASA_Lookup_Hostnames"
    let mutatehost = lookup_value("asa-hostname-lookuptable", $message.source);
    set_field("ASA_Host", mutatehost);

the above is (similar) working for me as you can see in this posting:

(Mariusgeonea) #22

if i use “lookup_value” it doesn’t create the new field “ASA_Host”, if i delete “_value” and leave only “lookup” i will have the same output as before :expressionless:

(Jan Doberstein) #23

Check the difference from the docs:

And the Lookup Docs:

(Mariusgeonea) #24

more than this when i have the lookup_value, i get this error “{“type”:“mapper_parsing_exception”,“reason”:“object mapping for [ASA_host] tried to parse field [ASA_host] as object, but found a concrete value”}”

(Jan Doberstein) #25

you should rotate the index - or change the field name. Elasticsearch has guessed the type of this field.

(Mariusgeonea) #26

i just have to say that you are the man, also tried it last night a couple of times, but nothing was showing, and i had no idea bout it.

once again many many thanks for the support Jan.
have a nice week-end man.

(system) #27

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.