elastic / elastic/integrations
[Cisco FTD]: Grok parse error on Message ID 305013
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Cisco FTD [cisco_ftd]
### Dataset Name
log
### Integration Version
3.10.2
### Agent Version
8.18.0
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.18.0
### OS Version and Architecture
Kubernetes Pod
### Software/API Version
_No response_
### Error Message
The Ingest Pipeline shows an error parsing the logs form the Cisco FTD.
**Grok Parse Error**
Processor conditional with tag 305013 in pipeline logs-cisco_ftd.log-3.10.2 failed with message: Provided Grok expressions do not match field value: [Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src Uplink-ISP:1.1.1.1 dst DMZ:2.2.2.2 (type 8, code 0) denied due to NAT reverse path failure]
### Event Original
<133>:: %FTD-session-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src Uplink-ISP:1.1.1.1 dst DMZ:2.2.2.2 (type 8, code 0) denied due to NAT reverse path failure
### What did you do?
Just added the integration to the agents.
### What did you see?
The error message.
### What did you expect to see?
Parsing the log without error.
### Anything else?
I made a Grok pattern analysis
**Suggestion for Fix**
^Asymmetric NAT rules matched for forward and reverse flows; Connection for %{NOTSPACE:network.transport} src %{DATA:_temp_.cisco.source_interface}:%{IPORHOST} dst %{DATA:_temp_.cisco.destination_interface}:%{IPORHOST} denied due to NAT reverse path failure
Contributor guide
Assessment
This issue has not been assessed yet.