elastic / elastic/integrations

[Cisco IOS]: Parse hostnames that starts with numbers

Open
#12,228 2 comments 0 reactions 0 assignees View on GitHub
Integration:cisco_ios Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Cisco IOS [cisco_ios]

### Dataset Name

cisco_ios.log

### Integration Version

1.28.1

### Agent Version

8.17.0

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.0

### OS Version and Architecture

Ubuntu 22.04 LTS (x86_64)

### Software/API Version

_No response_

### Error Message

We have several devices in production environment that has hostnames starting with a number like `1234.456-ABC-DEF`. The parser fails to understand this in the patterns and does not capture the hostname among other information.

### Event Original

<174>47858: 1234.456-ABC-DEF: 47850: Jan 5 11:34:54.724 PDT: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x

### What did you do?

![Image](https://github.com/user-attachments/assets/2fdf9983-6add-4478-a836-0b805955a9f9)

### What did you see?

```
{
"_index": ".ds-logs-cisco_ios.log-default-2024.12.16-000001",
"_id": "oasyOJQBmyYxhv8arfim",
"_version": 1,
"_source": {
"agent": {
"name": "xxxx",
"id": "f2f4b6d0-0651-4457-8fef-dd9ae0488a95",
"ephemeral_id": "ad1867cc-8443-4cbb-8f69-86d56398d001",
"type": "filebeat",
"version": "8.17.0"
},
"log": {
"source": {
"address": "x.x.x.x:52007"
},
"syslog": {
"priority": 174
}
},
"elastic_agent": {
"id": "f2f4b6d0-0651-4457-8fef-dd9ae0488a95",
"version": "8.17.0",
"snapshot": false
},
"message": "1234.456-ABC-DEF: 478914: Jan 5 12:40:21.923 PDT: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x",
"tags": [
"preserve_original_event",
"cisco-ios",
"forwarded"
],
"input": {
"type": "udp"
},
"observer": {
"product": "IOS",
"vendor": "Cisco",
"type": "firewall"
},
"@timestamp": "2025-01-05T20:40:22.915Z",
"ecs": {
"version": "8.11.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "cisco_ios.log"
},
"event": {
"agent_id_status": "verified",
"ingested": "2025-01-05T20:40:32Z",
"original": "<174>478922: 1234.456-ABC-DEF: 478914: Jan 5 12:40:21.923 PDT: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x",
"provider": "firewall",
"timezone": "+00:00",
"category": [
"network"
],
"type": [
"info"
],
"dataset": "cisco_ios.log"
},
"cisco": {
"ios": {
"uptime": "478922"
}
}
},
"fields": {
"elastic_agent.version": [
"8.17.0"
],
"event.category": [
"network"
],
"observer.vendor": [
"Cisco"
],
"agent.type": [
"filebeat"
],
"cisco.ios.uptime": [
"478922"
],
"event.module": [
"cisco_ios"
],
"agent.name.text": [
"fmt-elastic-agent-network"
],
"agent.name": [
"fmt-elastic-agent-network"
],
"observer.product": [
"IOS"
],
"elastic_agent.snapshot": [
false
],
"event.agent_id_status": [
"verified"
],
"log.syslog.priority": [
174
],
"event.timezone": [
"+00:00"
],
"event.original": [
"<174>478922: 1234.456-ABC-DEF: 478914: Jan 5 12:40:21.923 PDT: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x"
],
"elastic_agent.id": [
"f2f4b6d0-0651-4457-8fef-dd9ae0488a95"
],
"data_stream.namespace": [
"default"
],
"input.type": [
"udp"
],
"message": [
"1234.456-ABC-DEF: 478914: Jan 5 12:40:21.923 PDT: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x"
],
"data_stream.type": [
"logs"
],
"tags": [
"preserve_original_event",
"cisco-ios",
"forwarded"
],
"event.ingested": [
"2025-01-05T20:40:32.000Z"
],
"event.provider": [
"firewall"
],
"@timestamp": [
"2025-01-05T20:40:22.915Z"
],
"agent.id": [
"f2f4b6d0-0651-4457-8fef-dd9ae0488a95"
],
"ecs.version": [
"8.11.0"
],
"observer.type": [
"firewall"
],
"log.source.address": [
"x.x.x.x:52007"
],
"data_stream.dataset": [
"cisco_ios.log"
],
"event.type": [
"info"
],
"agent.ephemeral_id": [
"ad1867cc-8443-4cbb-8f69-86d56398d001"
],
"agent.version": [
"8.17.0"
],
"event.dataset": [
"cisco_ios.log"
]
}
}
```

### What did you expect to see?

I expected to see parsed information like hostname, timestamp, priorty and message etc in their respective fields. The message field should have `%CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x`

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.