elastic / elastic/integrations

Cisco Aironet: Pipeline error - Grok expression missmatch

Open
#14,797 2 comments 0 reactions 0 assignees View on GitHub
Integration:cisco_aironet maintainer:Community needs:triage Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Cisco Aironet [cisco_aironet]

### Dataset Name

cisco_aironet.log

### Integration Version

1.16.0

### Agent Version

9.0.4

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.0.4

### OS Version and Architecture

Running on ESS

### Software/API Version

_No response_

### Error Message

`Provided Grok expressions do not match field value: [Unable to add an ARP entry for 10.10.10.10 to the operating system. No such device.]`
`Provided Grok expressions do not match field value: [Unable to find Mobile 3a:49:65:09:e0:26 entry in the database, could not process send update message for Mobile]`
`Provided Grok expressions do not match field value: [Radius overrides disabled, ignoring source 4 [...It occurred 2 times.!]]`
`Provided Grok expressions do not match field value: [ Authentication Aborted for client 38:7f:8b:17:d8:68]`
`Provided Grok expressions do not match field value: [Unable to find Mobile 4e:b0:f7:2f:d3:fb entry in the database, could not process send update message for Mobile[...It occurred 3 times.!]]`
`Provided Grok expressions do not match field value: [Could not Register IP Add on MSCB. MSCB still in init state. mobility state, apfMsMmQueryRequested and client state, APF_MS_STATE_ASSOCIATEDaddress: 10:a5:1d:db:94:2b[...It occurred 2 times]`

### Event Original

`"<134>MYD-1310-WLC4: *rsyncmgrXferTrasport: Aug 04 09:40:47.701: %LOG-6-Q_IND: [SS]dtl_arp.c:1544 Unable to add an ARP entry for 10.10.10.10 to the operating system. No such device."`
`<132>MYD-1310-WLC4: *haSSOServiceTask1: Aug 04 09:40:04.434: %LOG-4-Q_IND: [SS]chkpt_message.c:3047 Invalid checkpoint client ID (0).[...It occurred 7 times.!]`
`<134>MYD-1310-WLC2: *Dot1x_NW_MsgTask_4: Aug 03 21:00:01.226: %LOG-6-Q_IND: [PA]apf_ms_radius_override.c:213 Radius overrides disabled, ignoring source 4`
`<131>MYD-1310-WLC-6: *Dot1x_NW_MsgTask_6: Aug 04 05:13:06.075: %DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:457 Authentication Aborted for client a2:d4:11:8a:3e:7e`
`<134>MYD-1310-WLC1: *Dot1x_NW_MsgTask_1: Aug 04 10:20:42.267: %LOG-6-Q_IND: [PA]apf_ha.c:376 Unable to find Mobile 68:b6:91:8c:ca:43 entry in the database, could not process send update message for Mobile`
`<132>MYD-1310-WLC-6: *dot1xMsgTask: Aug 04 10:17:40.717: %LOG-4-Q_IND: apf_foreignap.c:1752 Could not Register IP Add on MSCB. MSCB still in init state. mobility state, apfMsMmQueryRequested and client state, APF_MS_STATE_ASSOCIATEDaddress: 10:a5:1d:db:94:2b[...It occurred 2 times`

### What did you do?

We installed the integration and assigned it to a policy. No custom configuration of any kind was done. We are ingesting the logs over UDP

### What did you see?

That the pipeline does not work

### What did you expect to see?

a working ingest pipeline of the integration

### Anything else?

Catch all grok pattern to avoid these errors.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.