Dear Graylog Team , Is there any way in order to Make Cisco logs more comfortable in Graylog through any plugins For an example if am getting authentication fail logs how to extrace source , Destination , Port , and userid from the message and send an alert Via Mail Is there any way to customer …

Maybe this can help: [image] Is it possible to send Cisco Switch logs to Graylog Graylog Central (peer support) you will only need to define a Syslog Input on Graylog and after that configure your devices to send their syslog message to that created input. http://docs.gr…

Hey Zionio , I was able to receive cisco messages from syslog into graylog i want to extract source ip , destination ip , from the message can i know how

for that you use extractors or the processing pipeline.

as @jan said you can check on GL marketplace https://marketplace.graylog.org/addons?search=cisco Hope this helps :thinking:

Already tried this , no use of it

I have tried but unable to extract source ip and destination from a single message One of the log example : 100.65.203.6 334: Jan 12 15:43:55.889 IST: %SW_MATM-4-MACFLAP_NOTIF: Host 10f3.1149.2f20 in vlan 862 is flapping between port Gi0/26 and port Gi0/25 Please help me with the extraction of So…

Based on log example, you can create a GROK extractor with: %{IPV4:source_ip} %{GREEDYDATA} Host %{DATA:mac_accdress} in vlan %{INT:vlan} is flapping between port %{GREEDYDATA:port_a} and port %{GREEDYDATA:port_b} Remember to check: Named captures only [image] Hope this helps :thinking:

[image] itsmebalaji: MACFLAP_NOTIF Ziono I have applied the gork pattern but its not displaying in Graylog main page Field value

Can you show me a log example that did not match the GROK pattern created ?

It has been started working , is it possible to send the gork fields in email alert I mean i have extracted a specific fields from the message is it possible send only these fields in email alert Thanks & Regards , Balaji

Cisco Logs | Graylog

Graylog Central (peer support)

zionio (Andrea) January 12, 2018, 10:57am 2

Maybe this can help:

Topic		Replies	Views
Cisco on graylog Graylog Central (peer support)	4	1715	October 30, 2023
Log Cisco Messages Graylog Central (peer support)	20	13516	December 13, 2019
Problem to receive in interface log Graylog Central (peer support)	1	825	February 27, 2017
Problem with Cisco Routers / Switches with source value Graylog Central (peer support) pipeline-rules	2	2204	June 24, 2020
Source = :[ cisco syslog, any good way of fixing this? Graylog Central (peer support) pipeline-rules	3	1171	June 23, 2021

Cisco Logs | Graylog

Related topics