elastic / elastic/integrations

[cisco ios]: Add full Cisco IOS‑XE syslog parsing support

Open
#17,772 5 comments 0 reactions 1 assignee Claimed by @qcorporation View on GitHub
enhancement Integration:cisco_ios Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Cisco IOS [cisco_ios]

### Dataset Name

cisco_ios

### Integration Version

1.35.0

### Agent Version

9.2.6

### OS Version and Architecture

Ubuntu 20.04

### User Goal

I am trying to ingest and parse syslog messages from Cisco IOS‑XE devices, including those operating as Cisco SD‑WAN cEdge routers, into Elastic using the existing Cisco integration. The goal is to normalize these logs into ECS fields so they can be used effectively for search, dashboards, alerting, and SIEM use cases.
Specifically, I need Elastic to properly parse common IOS‑XE / SD‑WAN log types such as:

- Interface state changes
- BFD / OMP session events
- Routing adjacency changes
- Control connection changes
- Platform/system events
- General IOS‑XE subsystem logs

These logs follow Cisco’s IOS‑XE syslog format and are currently being ingested as raw messages without parsed fields.

### Existing Features

The existing Elastic Cisco integration provides limited support for Cisco log formats and does not include parsing pipelines for Cisco IOS‑XE syslog messages. As a result, logs from IOS‑XE and SD‑WAN cEdge routers are:

- Not parsed
- Not mapped to ECS
- Missing fields such as severity, event code, subsystem, interface name, or source/destination IP
- Not usable for dashboards, correlation, or SIEM detections

This significantly limits operational visibility and security monitoring for Cisco SD‑WAN deployments and any environment using IOS‑XE routers. Because SD‑WAN cEdge devices run IOS‑XE, the lack of IOS‑XE parsing directly prevents proper ingestion and use of SD‑WAN logs.
Adding IOS‑XE support would resolve these issues and bring the Cisco integration in line with the logging standards used across Cisco’s modern routing platforms.

### What did you see?

Image

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.