elastic / elastic/integrations
Cisco Aironet: Pipeline error - Grok expression missmatch
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Cisco Aironet [cisco_aironet]
### Dataset Name
cisco_aironet.log
### Integration Version
1.16.0
### Agent Version
9.0.4
### Agent Output Type
elasticsearch
### Elasticsearch Version
9.0.4
### OS Version and Architecture
Running on ESS
### Software/API Version
_No response_
### Error Message
`Provided Grok expressions do not match field value: [Unable to add an ARP entry for 10.10.10.10 to the operating system. No such device.]`
`Provided Grok expressions do not match field value: [Unable to find Mobile 3a:49:65:09:e0:26 entry in the database, could not process send update message for Mobile]`
`Provided Grok expressions do not match field value: [Radius overrides disabled, ignoring source 4 [...It occurred 2 times.!]]`
`Provided Grok expressions do not match field value: [ Authentication Aborted for client 38:7f:8b:17:d8:68]`
`Provided Grok expressions do not match field value: [Unable to find Mobile 4e:b0:f7:2f:d3:fb entry in the database, could not process send update message for Mobile[...It occurred 3 times.!]]`
`Provided Grok expressions do not match field value: [Could not Register IP Add on MSCB. MSCB still in init state. mobility state, apfMsMmQueryRequested and client state, APF_MS_STATE_ASSOCIATEDaddress: 10:a5:1d:db:94:2b[...It occurred 2 times]`
### Event Original
`"<134>MYD-1310-WLC4: *rsyncmgrXferTrasport: Aug 04 09:40:47.701: %LOG-6-Q_IND: [SS]dtl_arp.c:1544 Unable to add an ARP entry for 10.10.10.10 to the operating system. No such device."`
`<132>MYD-1310-WLC4: *haSSOServiceTask1: Aug 04 09:40:04.434: %LOG-4-Q_IND: [SS]chkpt_message.c:3047 Invalid checkpoint client ID (0).[...It occurred 7 times.!]`
`<134>MYD-1310-WLC2: *Dot1x_NW_MsgTask_4: Aug 03 21:00:01.226: %LOG-6-Q_IND: [PA]apf_ms_radius_override.c:213 Radius overrides disabled, ignoring source 4`
`<131>MYD-1310-WLC-6: *Dot1x_NW_MsgTask_6: Aug 04 05:13:06.075: %DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:457 Authentication Aborted for client a2:d4:11:8a:3e:7e`
`<134>MYD-1310-WLC1: *Dot1x_NW_MsgTask_1: Aug 04 10:20:42.267: %LOG-6-Q_IND: [PA]apf_ha.c:376 Unable to find Mobile 68:b6:91:8c:ca:43 entry in the database, could not process send update message for Mobile`
`<132>MYD-1310-WLC-6: *dot1xMsgTask: Aug 04 10:17:40.717: %LOG-4-Q_IND: apf_foreignap.c:1752 Could not Register IP Add on MSCB. MSCB still in init state. mobility state, apfMsMmQueryRequested and client state, APF_MS_STATE_ASSOCIATEDaddress: 10:a5:1d:db:94:2b[...It occurred 2 times`
### What did you do?
We installed the integration and assigned it to a policy. No custom configuration of any kind was done. We are ingesting the logs over UDP
### What did you see?
That the pipeline does not work
### What did you expect to see?
a working ingest pipeline of the integration
### Anything else?
Catch all grok pattern to avoid these errors.
Contributor guide
Assessment
This issue has not been assessed yet.