I would like to create some statistics for anyconnect sessions.
Raw message :
<164>Jan 1 2021 12:00:00: %ASA-4-113019: Group = dfltgroup, Username = test, IP = 18.104.22.168, Session disconnected. Session Type: AnyConnect-Parent, Duration: 0h:05m:06s, Bytes xmt: 718698, Bytes rcv: 1009019, Reason: User Requested
I’ve created an extractor to split the message and now have a field that looks like this : asa_anyconnect_session_duration : 0h:05m:06s
To do that I had to create a new GROK filter that looks like this :
Now my issue is that I would like to create a report that shows how long a user has been connected over a certain period (sum of session duration over a period of X)
Our Graylog, is running on ubuntu core 18.04.6 LTS in a 2 cluster config, running elastic 6.8.20, and a cluster of mongo DB using version 3.6.23.
any idea ?