logstash.conf

input {
  udp { port => 514 }
}

filter {
  # Pull the syslog part and Cisco tag out of the message
  grok {
    match => ["message", "%{CISCO_TAGGED_SYSLOG} %{GREEDYDATA:cisco_message}"]
  }

  # Parse the syslog severity and facility
  syslog_pri { }

  # Extract fields from the each of the detailed message types
  # The patterns provided below are included in core of LogStash 1.2.0.
  grok {
    match => [
      "cisco_message", "%{CISCOFW106001}",
      "cisco_message", "%{CISCOFW106006_106007_106010}",
      "cisco_message", "%{CISCOFW106014}",
      "cisco_message", "%{CISCOFW106015}",
      "cisco_message", "%{CISCOFW106021}",
      "cisco_message", "%{CISCOFW106023}",
      "cisco_message", "%{CISCOFW106100}",
      "cisco_message", "%{CISCOFW110002}",
      "cisco_message", "%{CISCOFW302010}",
      "cisco_message", "%{CISCOFW302013_302014_302015_302016}",
      "cisco_message", "%{CISCOFW302020_302021}",
      "cisco_message", "%{CISCOFW305011}",
      "cisco_message", "%{CISCOFW313001_313004_313008}",
      "cisco_message", "%{CISCOFW313005}",
      "cisco_message", "%{CISCOFW402117}",
      "cisco_message", "%{CISCOFW402119}",
      "cisco_message", "%{CISCOFW419001}",
      "cisco_message", "%{CISCOFW419002}",
      "cisco_message", "%{CISCOFW500004}",
      "cisco_message", "%{CISCOFW602303_602304}",
      "cisco_message", "%{CISCOFW710001_710002_710003_710005_710006}",
      "cisco_message", "%{CISCOFW713172}",
      "cisco_message", "%{CISCOFW733100}"
    ]
  }

  # Parse the date
  date {
    match => ["timestamp",
      "MMM dd HH:mm:ss",
      "MMM  d HH:mm:ss",
      "MMM dd yyyy HH:mm:ss",
      "MMM  d yyyy HH:mm:ss"
    ]
  }
}

output {
  elasticsearch_http { host => "localhost" }
}