elastic / elastic/integrations
[Cisco Secure Email Gateway]: Support for Grok parsing for logs coming from Cisco Secure Email Gateway in v 16.x
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Cisco Secure Email Gateway [cisco_secure_email_gateway]
### Dataset Name
_No response_
### Integration Version
16.x
### Agent Version
8.19
### OS Version and Architecture
Linux
### User Goal
Support for Grok parsing for logs coming from Cisco Secure Email Gateway in v 16.x
The integration worked with Cisco Secure Email Gateway server version 14.0.0; however, in 16.0.4-016 log format has changed, and processors are failing:
https://github.com/elastic/integrations/tree/main/packages/cisco_secure_email_gateway
Please add support for 16.0.4-016 log format to the integration.
This is the official guide for logging in Cisco Secure Email Gateway v16:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0/user_guide/b_ESA_Admin_Guide_16-0/b_ESA_Admin_Guide_12_1_chapter_0100111.html
### Existing Features
Working with version 14.0.0.
### What did you see?
After upgrading Cisco Secure Email Gateways (C695) to version 16.0.4-016, the status log messages changed.
Therefore, the grok filter in the ingest pipeline logs-cisco_secure_email_gateway.log-1.28.4-pipeline_status no longer matches.
**Log example before the update from Version 14.x:**
```
<22>Jan 21 12:47:11 host01 status: Info: Status: CPULd 100 DskIO 0 RAMUtil 1 QKUsd 5845 QKFre 71297323 CrtMID 16489343 CrtICID 16255845 CrtDCID 7670654 InjMsg 10526355 InjRcp 11030399 GenBncRcp 104192 RejRcp 683612 DrpMsg 1812 SftBncEvnt 317144 CmpRcp 11193532 HrdBncRcp 101388 DnsHrdBnc 12730 5XXHrdBnc 81837 FltrHrdBnc 0 ExpHrdBnc 6821 OtrHrdBnc 0 DlvRcp 11092050 DelRcp 94 GlbUnsbHt 0 ActvRcp 69 UnatmptRcp 50 AtmptRcp 19 CrtCncIn 0 CrtCncOut 1 DnsReq 84063667 NetReq 38886075 CchHit 87221963 CchMis 29533426 CchEct 3163403 CchExp 13749560 CPUTTm 11726 CPUETm 108140 MaxIO 74468 RAMUsd 397968752 MMLen 68 DstInMem 1201 ResCon 0 WorkQ 0 QuarMsgs 0 QuarQKUsd 0 LogUsd 2 SophLd 0 BMLd 0 CASELd 0 TotalLd 5 LogAvail 1T EuQ 0 EuqRls 0 CmrkLd 0 McafLd 0 SwIn 0 SwOut 0 SwPgIn 0 SwPgOut 0 **SwapUsage 0%** RptLd 0 QtnLd 0 EncrQ 0 InjBytes 654567997394
```
**Logs from the version 16.0.4-016:**
```
<22>Feb 02 10:31:37 host01 status: Info: Status: CPULd 13 DskIO 1 RAMUtil 1 QKUsd 3948 QKFre 71299220 CrtMID 16981659 CrtICID 16651044 CrtDCID 7883589 InjMsg 10842391 InjRcp 11359883 GenBncRcp 107129 RejRcp 697333 DrpMsg 1812 SftBncEvnt 325208 CmpRcp 11527163 HrdBncRcp 103934 DnsHrdBnc 13161 5XXHrdBnc 83745 FltrHrdBnc 0 ExpHrdBnc 7028 OtrHrdBnc 0 DlvRcp 11423132 DelRcp 97 GlbUnsbHt 0 ActvRcp 114 UnatmptRcp 99 AtmptRcp 15 CrtCncIn 2 CrtCncOut 5 DnsReq 86455318 NetReq 40002337 CchHit 89702470 CchMis 30363538 CchEct 3211676 CchExp 14136433 CPUTTm 72737 CPUETm 1027634 MaxIO 74468 RAMUsd 551857550 MMLen 115 DstInMem 1137 ResCon 0 WorkQ 0 QuarMsgs 1 QuarQKUsd 989 LogUsd 2 SophLd 0 BMLd 0 CASELd 6 TotalLd 4 LogAvail 1T EuQ 0 EuqRls 0 CmrkLd 0 McafLd 0 SwIn 0 SwOut 0 SwPgIn 0 SwPgOut 0 RptLd 2 QtnLd 0 EncrQ 0 InjBytes 884593308600
```
The **SwapUsage** is missing in the new version.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.