☰

使用 syslog ng 获取思科路由器日志的 json 输出文件

tag-icon • tag-icon cisco logging syslog-ng
使用 syslog ng 获取思科路由器日志的 json 输出文件

思科路由器的日志如下

Sep 18 20:55:30 2405:XXX:204:XXX:172:22:XXX:25 93596: 093382: Sep 18 20:53:17.848 IST: %TCP-6-BADAUTH: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to 2405:XXX:201:XXX:172:22:XXX:25(15616) (RST) tableid - 0

我想要使​​用 syslog ng 的每个日志的键值对，如下所示：

"@timestamp": "Sep 18 20:55:30",
  "host": "2405:XXX:204:XXX:172:22:XXX:25",
  "seq_no1": "93596",
  "seq_no2": "093382",
  "@timestamp1": "Sep 18 20:53:17.848",
  "protocol": "TCP"
  "severity": "6"
  "message": "BADAUTH",
  "msg": "575387: No MD5 digest from 2405:XXX:201:201:XXX:22:193:30(179) to 2405:XXX:201:XXX:172:22:XXX:25(15616) (RST) tableid - 0"

需要在我的 syslog-ng.conf 文件中使用此模式匹配正则表达式的帮助。

destination d_cisco{
  file("/var/log/cisco/all_syslog_in_json.log"perm(0666)template("{\"@timestamp\": \"$ISODATE\", \"host\": \"$HOST\", \"seq_no1\": \"$SEQNUM\", \"seq_no2\": \"$SEQNUM\", \"@timestamp1\": \"$ISODATE\", \"protocol-severity-message\": \"$FAC-SEV-MNEMONIC\", \"message\": \"$MSG\"}\n"));
};

相关内容