Nagios Support Forum

Wanted to pass on a reminder for everyone to update your Logstash patterns.

I was having issues with Logstash not parsing the Cisco ASA-6-302016 messages correctly, leading to a grokparsefailure. Found this GitHub thread: https://github.com/elastic/logstash/issues/1369 that addressed it.

Since Logstash v1.5, Logstash maintains their built-in patterns separately from their app code. You can update your built-in patterns by:
Which should give you an output like: Keep calm and parse on.

-Andrew

Thanks for the heads up!

Should also note that you'll need to update the grok filters that call those patterns as well. Check for definitions here: https://github.com/logstash-plugins/log ... r/patterns

Thank you for posting that, I'm sure future visitors will find it helpful. Are we okay to close this thread or is there anything else related that we can help with?

Lock it up!