elastic / elastic/integrations

[Cisco FTD]: Grok parse error on Message ID 305013

Open
#15,617 2 comments 0 reactions 0 assignees View on GitHub
Integration:cisco_ftd needs:triage Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Cisco FTD [cisco_ftd]

### Dataset Name

log

### Integration Version

3.10.2

### Agent Version

8.18.0

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.18.0

### OS Version and Architecture

Kubernetes Pod

### Software/API Version

_No response_

### Error Message

The Ingest Pipeline shows an error parsing the logs form the Cisco FTD.

**Grok Parse Error**
Processor conditional with tag 305013 in pipeline logs-cisco_ftd.log-3.10.2 failed with message: Provided Grok expressions do not match field value: [Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src Uplink-ISP:1.1.1.1 dst DMZ:2.2.2.2 (type 8, code 0) denied due to NAT reverse path failure]

### Event Original

<133>:: %FTD-session-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src Uplink-ISP:1.1.1.1 dst DMZ:2.2.2.2 (type 8, code 0) denied due to NAT reverse path failure

### What did you do?

Just added the integration to the agents.

### What did you see?

The error message.

### What did you expect to see?

Parsing the log without error.

### Anything else?

I made a Grok pattern analysis

**Suggestion for Fix**
^Asymmetric NAT rules matched for forward and reverse flows; Connection for %{NOTSPACE:network.transport} src %{DATA:_temp_.cisco.source_interface}:%{IPORHOST} dst %{DATA:_temp_.cisco.destination_interface}:%{IPORHOST} denied due to NAT reverse path failure

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.