improved cisco ACI processor #377
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Improved the cisco aci processor with the following changes: 1) simplified grok parsing 2) removed complex logic used to detected event and error messages 3) fixed broken parsing of the device hostname sending logs 4) tmp.rule does NOT rapresent an username , it's instead the even.reason as described by cisco, - The action or condition that caused the event, such as a component failure or a threshold crossing. sample messages used for testing ``` <186>Dec 08 21:20:20.614 ABC-DCA-NPRD-ACILEF-104 %LOG_LOCAL7-2-SYSTEM_MSG [F0532][raised][interface-physical-down][critical][sys/phys-[eth1/47]/phys/fault-F0532] Port is down, reason being suspended(no LACP PDUs)(connected), used by EPG on node 104 of fabric ACI Fabric1 with hostname CLS-DCE-NPRD-ACILEF-10 <190>Nov 24 18:20:53.237 ABC-DCB-ACIAPC-003 %LOG_LOCAL7-6-SYSTEM_MSG [E4206143][transition][info][fwrepo/fw-aci-apic-dk9.5.2.6e] Firmware aci-apic-dk9.5.2.6e created ```
fixed mistake where error_message was used instead of [tmp][error_message]
Fault isn't a valid value for the field event.kind according to ECS - https://www.elastic.co/guide/en/ecs/8.5/ecs-allowed-values-event-kind.html use "alert" instead of fault
don't save a field with no value. -SYSTEM_MS is always there and not providing any meaning information.
let's not forget lookup table
|
Added lookup of the error code. |
restore observer name clean up as that depends on the input pipeline not on ACI itself
|
We'll merge this after holidays. |
ghost
previously approved these changes
Dec 19, 2022
full fault codes updated
use newer dictionary
|
i'll have to ask for a newer review, but all i did was to have the proper dictionary now being loaded |
KrishnanandSingh
requested review from
a user
and removed request for
a user
brian-grabau
approved these changes
Jan 3, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Improved the cisco aci processor with the following changes:
sample messages used for testing