[
https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16832508#comment-16832508
]
Simon Elliston Ball commented on METRON-2105:
---------------------------------------------
I really like this idea. The grok parser is probably ok as a short term
solution, maybe filtering out the messages the ASA parser doesn't cover right
now.
[~ottobackwards] The ciscotag field is used to determine which ASA grok pattern
is necessary for the message, so is sort of a router to the right pattern.
Given the variety of different message types on an ASA source, you can't just
parse all of it with a single grok (or at least not with a sane pattern!),
hence the tag.
> Enhance BasicAsaParser to add patterns dynamically
> --------------------------------------------------
>
> Key: METRON-2105
> URL: https://issues.apache.org/jira/browse/METRON-2105
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.7.0, 0.7.1
> Reporter: Pieter Baele
> Priority: Critical
>
> The current implementation of the ASA parser uses a static patternMap. As a
> result, the parser needs recompilation when patterns are added.
> An enhancement would be dyamic reload capabilities based on a mapping file
> using ciscotag and grok patterns loaded using hdfs.
> This can be especially important regarding the number of patterns that can be
> introduced by 3-th party commiters as the list of possible messages is quite
> long [https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html]
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
