Skip to content

Commit e4dc0d2

Browse files
committed
Parse 302018 messages correctly
1 parent 2aa1cad commit e4dc0d2

File tree

3 files changed

+132
-9
lines changed

3 files changed

+132
-9
lines changed

packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,3 +279,4 @@ Feb 3 10:07:37 myhost.example.com : Feb 03 10:07:37 EST: %ASA-svc-3-722035: Grou
279279
Feb 3 10:07:51 myhost.example.com : Feb 03 10:07:50 EST: %ASA-4-733100: [ LOCAL\[email protected]#012 ] drop rate-1 exceeded. Current burst rate is 40 per second, max configured rate is 40; Current average rate is 2 per second, max configured rate is 20; Cumulative total count is 1486
280280
<166>10.1.1.1 %ASA-6-302021: Teardown ICMP connection for faddr 2001:db8:85a3::8a2e:370:7334/9 gaddr 2001:db8:85a3::8a2e:370:7335/0 laddr 2001:db8:85a3::8a2e:370:7335/0 type 128 code 0 \n
281281
<166>10.1.1.1 %ASA-6-302020: Built outbound ICMP connection for faddr 2001:db8:85a3::8a2e:370:7334/0 gaddr ::ffff:10.10.4.4/0 laddr ::ffff:10.10.10.4/0 type 3 code 0 Internal-Data0/0:RX[29]
282+
<166>10.1.1.1 %ASA-6-302018: Teardown GRE connection 472592149 from Outside:81.2.69.142 to Inside:89.160.20.156/0 duration 0:02:01 bytes 1344 0 26

packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23480,6 +23480,124 @@
2348023480
"tags": [
2348123481
"preserve_original_event"
2348223482
]
23483+
},
23484+
{
23485+
"@timestamp": "2025-01-01T12:00:00.000Z",
23486+
"cisco": {
23487+
"asa": {
23488+
"connection_id": "472592149",
23489+
"destination_interface": "Inside",
23490+
"source_interface": "Outside"
23491+
}
23492+
},
23493+
"destination": {
23494+
"address": "89.160.20.156",
23495+
"as": {
23496+
"number": 29518,
23497+
"organization": {
23498+
"name": "Bredband2 AB"
23499+
}
23500+
},
23501+
"geo": {
23502+
"city_name": "Linköping",
23503+
"continent_name": "Europe",
23504+
"country_iso_code": "SE",
23505+
"country_name": "Sweden",
23506+
"location": {
23507+
"lat": 58.4167,
23508+
"lon": 15.6167
23509+
},
23510+
"region_iso_code": "SE-E",
23511+
"region_name": "Östergötland County"
23512+
},
23513+
"ip": "89.160.20.156",
23514+
"port": 0
23515+
},
23516+
"ecs": {
23517+
"version": "8.17.0"
23518+
},
23519+
"event": {
23520+
"action": "flow-expiration",
23521+
"category": [
23522+
"network"
23523+
],
23524+
"code": "302018",
23525+
"duration": 121000000000,
23526+
"kind": "event",
23527+
"original": "<166>10.1.1.1 %ASA-6-302018: Teardown GRE connection 472592149 from Outside:81.2.69.142 to Inside:89.160.20.156/0 duration 0:02:01 bytes 1344 0 26",
23528+
"outcome": "success",
23529+
"severity": 6,
23530+
"timezone": "UTC",
23531+
"type": [
23532+
"connection",
23533+
"end"
23534+
]
23535+
},
23536+
"host": {
23537+
"hostname": "10.1.1.1"
23538+
},
23539+
"log": {
23540+
"level": "informational",
23541+
"syslog": {
23542+
"facility": {
23543+
"code": 20
23544+
},
23545+
"priority": 166,
23546+
"severity": {
23547+
"code": 6
23548+
}
23549+
}
23550+
},
23551+
"network": {
23552+
"bytes": 1344,
23553+
"community_id": "1:G+7NhVep/VU/WFsZ87fgaCpx6Ks=",
23554+
"iana_number": "47",
23555+
"transport": "gre"
23556+
},
23557+
"observer": {
23558+
"egress": {
23559+
"interface": {
23560+
"name": "Inside"
23561+
}
23562+
},
23563+
"hostname": "10.1.1.1",
23564+
"ingress": {
23565+
"interface": {
23566+
"name": "Outside"
23567+
}
23568+
},
23569+
"product": "asa",
23570+
"type": "firewall",
23571+
"vendor": "Cisco"
23572+
},
23573+
"related": {
23574+
"hosts": [
23575+
"10.1.1.1"
23576+
],
23577+
"ip": [
23578+
"81.2.69.142",
23579+
"89.160.20.156"
23580+
]
23581+
},
23582+
"source": {
23583+
"address": "81.2.69.142",
23584+
"geo": {
23585+
"city_name": "London",
23586+
"continent_name": "Europe",
23587+
"country_iso_code": "GB",
23588+
"country_name": "United Kingdom",
23589+
"location": {
23590+
"lat": 51.5142,
23591+
"lon": -0.0931
23592+
},
23593+
"region_iso_code": "GB-ENG",
23594+
"region_name": "England"
23595+
},
23596+
"ip": "81.2.69.142"
23597+
},
23598+
"tags": [
23599+
"preserve_original_event"
23600+
]
2348323601
}
2348423602
]
2348523603
}

packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1229,14 +1229,14 @@ processors:
12291229
if: '["302014", "302016", "302018", "302021", "302036", "302304", "302306"].contains(ctx._temp_.cisco.message_id)'
12301230
description: "302014, 302016, 302018, 302021, 302036, 302304, 302306"
12311231
patterns:
1232-
12331232
- ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_SRC}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_DST}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason} from %{NOTCOLON:_temp_.cisco.termination_initiator} \(%{CISCO_USER:_temp_.cisco.termination_user}\)
12341233
- ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_SRC}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_DST}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason} from %{NOTCOLON:_temp_.cisco.termination_initiator}
12351234
- ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_SRC}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_DST}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason} \(%{CISCO_USER:_temp_.cisco.termination_user}\)
12361235
- ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_SRC}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_DST}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) \(%{CISCO_USER:_temp_.cisco.termination_user}\)
12371236
- ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_SRC}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_DST}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}) %{NOTCOLON:event.reason}
12381237
- ^Teardown %{NOTSPACE:network.transport} (?:state-bypass )?connection %{NOTSPACE:_temp_.cisco.connection_id} (?:for|from) %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address}/%{NUMBER:source.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_SRC}\)? )?to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int}\s*(?:\(?%{CISCO_USER_OR_SGT_DST}\)? )?duration (?:%{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes})
12391238
- ^Teardown %{NOTSPACE:network.transport} connection for faddr (?:%{ECSDESTIPORHOST}|%{NOTCOLON:_temp_.cisco.source_interface}:%{ECSDESTIPORHOST})/%{NUMBER}\s*(?:\(?%{CISCO_USER_OR_SGT_DST}\)? )?gaddr (?:%{MAPPEDSRC}|%{NOTCOLON:_temp_.cisco.gaddr_interface}:%{MAPPEDSRC})/%{NUMBER} laddr (?:%{ECSSOURCEIPORHOST}|%{NOTCOLON:_temp_.cisco.source_interface}:%{ECSSOURCEIPORHOST})/%{NUMBER}\s*(?:\(%{CISCO_USER_OR_SGT_SRC}\))?(\s*type %{NUMBER:_temp_.cisco.icmp_type} code %{NUMBER:_temp_.cisco.icmp_code})?
1239+
- ^Teardown %{NOTSPACE:network.transport} connection %{NOTSPACE:_temp_.cisco.connection_id} from %{NOTCOLON:_temp_.cisco.source_interface}:%{DATA:source.address} to %{NOTCOLON:_temp_.cisco.destination_interface}:%{DATA:destination.address}/%{NUMBER:destination.port:int} duration %{DURATION:_temp_.duration_hms} bytes %{NUMBER:network.bytes}(?:%{NUMBER} %{NUMBER})?
12401240
pattern_definitions:
12411241
HOSTNAME: "\\b(?:[0-9A-Za-z][0-9A-Za-z\\-_]{0,62})(?:\\.(?:[0-9A-Za-z][0-9A-Za-z\\-_]{0,62}))*(\\.?|\\b)"
12421242
IPORHOST: "(?:%{IP}|%{HOSTNAME})"
@@ -1833,7 +1833,7 @@ processors:
18331833
tag: script_process_flow_duration
18341834
lang: painless
18351835
if: "ctx?._temp_?.duration_hms != null"
1836-
source: >
1836+
source: |
18371837
long parse_hms(String s) {
18381838
long cur = 0, total = 0;
18391839
for (char c: s.toCharArray()) {
@@ -1842,22 +1842,26 @@ processors:
18421842
} else if (c == (char)':') {
18431843
total = (total + cur) * 60;
18441844
cur = 0;
1845-
} else if (c != (char)'h' && c == (char)'m' && c == (char)'s') {
1846-
return 0;
18471845
}
18481846
}
18491847
return total + cur;
18501848
}
18511849
if (ctx?.event == null) {
18521850
ctx['event'] = new HashMap();
18531851
}
1854-
String end = ctx['@timestamp'];
1855-
ctx.event['end'] = end;
18561852
long nanos = parse_hms(ctx._temp_.duration_hms) * 1000000000L;
18571853
ctx.event['duration'] = nanos;
1858-
ctx.event['start'] = ZonedDateTime.ofInstant(
1859-
Instant.parse(end).minusNanos(nanos),
1860-
ZoneOffset.UTC);
1854+
if (ctx['@timestamp'] != null) {
1855+
String end = ctx['@timestamp'];
1856+
ctx.event['end'] = end;
1857+
try {
1858+
ctx.event['start'] = ZonedDateTime.ofInstant(
1859+
Instant.parse(end).minusNanos(nanos),
1860+
ZoneOffset.UTC);
1861+
} catch (Exception e) {
1862+
// If timestamp parsing fails, just set duration
1863+
}
1864+
}
18611865
#
18621866
# Parse Source/Dest Username/Domain may contain SGT
18631867
#

0 commit comments

Comments
 (0)