combo.conf

input {
#    udp {
#        port => "514"
#        type => "transparent"
#    }
# ^^^ needs root?
    udp {
        port => "5140"
        type => "transparent"
    }
    udp {
        port => "5141"
        type => "syslog-cisco-xr"
    }
    udp {
        port => "5142"
        type => "syslog-cisco-xe"
    }
    udp {
        port => "5143"
        type => "syslog-cisco-asa"
    }
    udp {
        port => "5144"
        type => "syslog-nokia-timos"
    }
    udp {
        port => "5145"
        type => "syslog-ne"
    }
}


filter {
    # NOTE: The frontend logstash servers set the type of incoming messages.
    # Routers are sending the same message to all syslog servers for redundancy, this allows us to
    ## only store the message in elasticsearch once by generating a hash of the message and using that as
    ## the document_id.
    fingerprint {
        source              => [ "message" ]
        method              => "SHA1"
        key                 => "Some super secret passphrase for uniqueness."
        concatenate_sources => true
    }

    if [type] == "syslog-cisco-xr" {

        # FILTER - IOS XR format
        #
        # Configuration:
        # clock timezone EET 2
        # service timestamps log datetime localtime msec show-timezone year
        # service timestamps debug datetime localtime msec show-timezone year
        # logging format rfc5424/bsd
        # logging 10.10.10.10 vrf default severity info port 5141
        # logging source-interface Loopback0
        # logging hostnameprefix __DISCOBEAR
        # logging suppress duplicates

        # Parse the log entry into sections.  Cisco doesn't use a consistent log format, unfortunately.

        grok {

          # There are a couple of custom patterns associated with this filter.
          # patterns_dir => [ "/usr/share/logstash/patterns" ]

          match => [
            # IOS-XR BSD Log Format
            # "message", "<%{POSINT:pri}>%{DATA:log_date}__%{DATA:hostname} %{DATA:slot}:%{DATA:job_id}: %%{DATA:facility}-%{INT:lvl}-%{DATA:facility_mnemonic} : %{GREEDYDATA:message}",
            # IOS-XR RFC5424 Logs
            # v0.1 "message", "<%{POSINT:pri}>%{POSINT:version}%{SPACE}%{DATA:log_date}%{SPACE}__%{DATA:hostname} %{DATA:extjob}: %{DATA:slot}:%{DATA:job_id}: %%{DATA:facility}-%{INT:lvl}-%{DATA:facility_mnemonic} : %{GREEDYDATA:message}"
            # v0.2 "message", "<%{POSINT:pri}>%{POSINT:version} %{YEAR:year} %{MONTH:month} %{MONTHDAY:monthday} %{TIME:time} %{DATA:tz} %{DATA:hostname} %{DATA:extjob}: %{DATA:slot}:%{DATA:job_id}: %%{DATA:facility}-%{INT:lvl}-%{DATA:facility_mnemonic} : %{GREEDYDATA:message}"
            # Default XR with YEAR and TZ
            "message", "<%{POSINT:pri}>%{POSINT:seq}: %{DATA:hostname} %{DATA:slot}:(%{YEAR:year})? %{MONTH:month}(%{SPACE})+%{MONTHDAY:monthday} %{TIME:time} (%{DATA:tz})?:%{DATA:job_id}: %%{DATA:facility}-%{INT:lvl}-%{DATA:facility_mnemonic} : %{GREEDYDATA:message}"
          ]
    
          overwrite => [ "message" ]
          add_tag => [ "iosxr" ]
          remove_field => [ "pri", "@version" ]
        } # grok
    } # if type

    if [type] == "syslog-cisco-xe" {

        # FILTER - IOS XE
        #
        # Configuration:
        # clock timezone EET 2 0
        # service timestamps debug datetime msec localtime show-timezone year
        # service timestamps log datetime msec localtime show-timezone year
        # service sequence-numbers
        # no logging count
        # logging trap debugging
        # logging origin-id hostname
        # logging host 10.10.10.10 transport udp port 5142

        grok {

            # patterns_dir => [ "/usr/share/logstash/patterns" ]
            match => [
                # IOS-XE Log Format
                "message", "<%{POSINT:pri}>(%{POSINT:seq2}: )?(%{DATA:hostname}: )?(%{NUMBER:seq}: )?(\.)?%{DATA:log_date}: %%{DATA:facility}-%{DATA:lvl}-%{DATA:facility_mnemonic}: %{GREEDYDATA:message}"
            ]
    
            overwrite => [ "message" ]
            add_tag => [ "cisco", "iosxe" ]
            remove_field => [ "pri", "seq2", "@version" ]
        } # grok
    } # if type

    if [type] == "syslog-cisco-asa" {

        # Cisco ASA
        #
        # Configuration

        grok {
            match => [
                "message", "<%{POSINT:pri}>%{MONTH:month} %{MONTHDAY:monthday} %{YEAR:year} %{TIME:time} %{DATA:hostname} : %%{DATA:facility}-%{POSINT:lvl}-%{DATA:facility_mnemonic}: %{GREEDYDATA:message}"
            ]
            overwrite => [ "message" ]
            add_tag => [ "asa" ]
            remove_field => [ "pri", "@version" ]
        } # grok
    } # if type

    if [type] == "syslog-ne" {

        # FILTER - NE log format
        #
        # Configuration:
        # info-center source default channel 0 log state off trap state off
        # info-center source default channel 4 log level debugging
        # info-center loghost 10.10.10.10 source-ip 1.1.1.1 port 5145 local-time
        # info-center timestamp log format-date precision-time millisecond
        # info-center timestamp trap format-date precision-time millisecond

        grok {

            # patterns_dir => [ "/usr/share/logstash/patterns" ]
            match => [
              # NE Logs
              "message", "<%{POSINT:pri}>%{TIMESTAMP_ISO8601:log_date}%{SPACE}%{DATA:hostname}%{SPACE}%%%{DATA:facility}/%{POSINT:lvl}/%{DATA:facility_mnemonic}:%{DATA:cid};%{GREEDYDATA:message}"
            ]
      
            overwrite => [ "message" ]
            add_tag => [ "ne", "ISO8601" ]
            remove_field => [ "pri", "@version" ]
        } # grok
    } # if type

    if [type] == "syslog-nokia-timos" {

        # FILTER - Nokia TiMOS log format
        #
        # Configuration:
        # /configure log syslog 1 log-prefix 7210SASMXPLAB1
        # /configure log syslog 1 description LOGSTASH
        # /configure log syslog 1 address 10.10.10.10
        # /configure log syslog 1 port 5144
        # /configure log log-id 85 time-format local
        # /configure log log-id 90 time-format local
        # /configure log log-id 95 time-format local
        # /configure log log-id 97 time-format local

        grok {
            # patterns_dir => [ "/usr/share/logstash/patterns" ]
      
            match => [
              # Nokia Logs
              "message", "<%{POSINT:pri}>%{CISCOTIMESTAMP:log_date} %{DATA:hostip} %{DATA:hostname}: %{POSINT:seq} %{DATA:base} %{DATA:facility}-%{DATA:lvl}-%{DATA:facility_mnemonic}-%{GREEDYDATA:message}"
            ]
      
            overwrite => [ "message" ]
            add_tag => [ "timos", "nokia", "ISO8601" ]
            remove_field => [ "pri", "@version" ]
        } # grok
    } # if type

    # If we made it here, the grok was sucessful
    if "cisco" in [tags] {
        date {
            match => [
                "log_date",

                # IOS
                "MMM dd HH:mm:ss.SSS ZZZ",
                "MMM dd HH:mm:ss ZZZ",
                "MMM dd HH:mm:ss.SSS",
                "MMM dd YYYY HH:mm:ss.SSS ZZZ",
                "MMM dd YYYY HH:mm:ss ZZZ",
                "MMM dd YYYY HH:mm:ss.SSS",
                "MMM  d YYYY HH:mm:ss.SSS ZZZ",
                "MMM  d YYYY HH:mm:ss",
                "MMM dd YYYY HH:mm:ss",        

                # Nexus
                "YYYY MMM dd HH:mm:ss.SSS ZZZ",
                "YYYY MMM dd HH:mm:ss ZZZ",
                "YYYY MMM dd HH:mm:ss.SSS",
        
                # Hail Mary
                "ISO8601"
            ]
        } # date
    } # if tags

    if "ISO8601" in [tags] {
        date {  
            match => [  
                "log_date",  
                "ISO8601"  
            ]
        } # date
    } # if tags

    if "iosxr" in [tags] {
        mutate {
            add_field => {
                "log_date" => "%{monthday}/%{month}/%{year}:%{time}"
            }
        }
        date {
            locale => "en"
            timezone => "EET"
            match => ["log_date", "dd/MMM/yyyy:HH:mm:ss.SSS"]
            target => "@timestamp"
            remove_field => [ "month", "monthday", "year", "time"] #log_date
        }
    } # if tags

    if "asa" in [tags] {
        mutate {
            add_field => {
                "log_date" => "%{monthday}/%{month}/%{year}:%{time}"
            }
        }
        date {
            locale => "en"
            # TODO: Flexible timezone
            timezone => "EET"
            match => ["log_date", "dd/MMM/yyyy:HH:mm:ss"]
            target => "@timestamp"
            remove_field => [ "month", "monthday", "year", "time"] #log_date
        }
    } # if tags

    # Add the log level name instead of just a number.
    mutate {
        gsub => [
            "lvl", "0", "0 emerg",
            "lvl", "1", "1 alert",
            "lvl", "2", "2 critical",
            "lvl", "3", "3 error",
            "lvl", "4", "4 warning",
            "lvl", "5", "5 notice",
            "lvl", "6", "6 info",
            "lvl", "7", "7 debug"
        ]
    } # mutate
} # filter


output { 
    elasticsearch {
        hosts => "127.0.0.1:9200"
        index => "syslogindex"
    }
}