Processing ASA logs in LogStash after having passed through rsyslog, with thanks to PinkFreud on IRC in the #logstash channel on FreeNode

gistfile1.txt

input {
  tcp {
    port => 5000
    type => syslog
  }
  udp {
    port => 5000
    type => syslog
  }
}


filter {
  if [type] == "syslog" {
    grok {
        match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?:? %{GREEDYDATA:syslog_message}" }
        add_field => [ "received_at", "%{@timestamp}" ]
        add_field => [ "received_from", "%{@source_host}" ]
    }


    syslog_pri {
    }

    if [syslog_program] =~ "%ASA-\d+-\d+" {
      grok {
        match => [
          "syslog_message", "%{CISCOFW106001}",
          "syslog_message", "%{CISCOFW106006_106007_106010}",
          "syslog_message", "%{CISCOFW106014}",
          "syslog_message", "%{CISCOFW106015}",
          "syslog_message", "%{CISCOFW106021}",
          "syslog_message", "%{CISCOFW106023}",
          "syslog_message", "%{CISCOFW106100}",
          "syslog_message", "%{CISCOFW110002}",
          "syslog_message", "%{CISCOFW302010}",
          "syslog_message", "%{CISCOFW302013_302014_302015_302016}",
          "syslog_message", "%{CISCOFW302020_302021}",
          "syslog_message", "%{CISCOFW305011}",
          "syslog_message", "%{CISCOFW313001_313004_313008}",
          "syslog_message", "%{CISCOFW313005}",
          "syslog_message", "%{CISCOFW402117}",
          "syslog_message", "%{CISCOFW402119}",
          "syslog_message", "%{CISCOFW419001}",
          "syslog_message", "%{CISCOFW419002}",
          "syslog_message", "%{CISCOFW500004}",
          "syslog_message", "%{CISCOFW602303_602304}",
          "syslog_message", "%{CISCOFW710001_710002_710003_710005_710006}",
          "syslog_message", "%{CISCOFW713172}",
          "syslog_message", "%{CISCOFW733100}"
        ]
        tag_on_failure => ["_ciscoparsefailure"]
      }
    }

    date {
        match => ["timestamp",
          "MMM dd HH:mm:ss",
          "MMM  d HH:mm:ss",
          "MMM dd yyyy HH:mm:ss",
          "MMM  d yyyy HH:mm:ss"
        ]
    }

    if !("_grokparsefailure" in [tags]) {
      mutate {
          replace => [ "host", "%{syslog_hostname}" ]
          replace => [ "message", "%{syslog_message}" ]
      }
    }
    mutate {
      replace => [ "host", "%{syslog_hostname}" ]
      replace => [ "message", "%{syslog_message}" ]
    }
  }
}

output {
  # Example just to output to elasticsearch
  elasticsearch { embedded => false }
  stdout { }
}