Hi,
two days ago I set up my first graylog instance.
Currently I am just streaming in syslog message from an Cisco ASA.
I have found the marketplace and added some extraktors, which are working fine.
Now I want to add my own extractor for a special kind of message but I can’t find the reason why Graylog always says: " Please check your parameters.".
I have tried different ways, looked into those extractors from the marketplace to compare but it did not help.
My current solution looks like:
<166>Sep 11 2020 12:51:02: %ASA-6-113039: Group User <dirk.testaccount> IP <87.143.68.6> AnyConnect parent session started.
I have used a regex
^.*: %ASA-6-113039: Group (.+) User
and Graylog says: “Matches! Extractor would run against this example.”
Thats fine.
My grok pattern currenlty looks like:
ASA-\d-%{WORD:asa_messageid:int}: Group <%{WORD:asa_grouppolicy}> User <%{USERNAME:asa_vpnuser}> IP <%{IPV4:asa_vpn_remoteip}>
Somewhere I read that I have to use the backslash in front of the < sign.
Maybe someone sees instantly what I am doing wrong. I am trying for hours now…