Update cisco_ucs_extractors

dcecchino · Jan 20, 2021 · 4ea94aa · 4ea94aa
1 parent b2342f7
commit 4ea94aa
Showing 1 changed file with 15 additions and 43 deletions.
diff --git a/cisco_ucs_extractors b/cisco_ucs_extractors
@@ -1,113 +1,85 @@
 {
   "extractors": [ 
-{
-      "title": "Cisco UCS Call Home Event",
-      "extractor_type": "grok",
-      "converters": [],
-      "order": 0,
-      "cursor_strategy": "copy",
-      "source_field": "message",
-      "target_field": "",
-      "extractor_config": {
-        "grok_pattern": "%{DATA:CISCO_CALL_HOME_EVENT}\\: %{GREEDYDATA:SAM_ALERT_DIAGNOSTIC_MAJOR}"
-      },
-      "condition_type": "none",
-      "condition_value": ""
-    },
-    {
-      "title": "Cisco UCS FEX Status 1",
+  {
+      "title": "Cisco UCS CIMC Error",
       "extractor_type": "grok",
       "converters": [],
       "order": 0,
       "cursor_strategy": "copy",
       "source_field": "message",
       "target_field": "",
       "extractor_config": {
-        "grok_pattern": "%{DATA:CISCO_FEX_MSG}\\: %{DATA:CISCO_FEX_ID} %{GREEDYDATA:CISCO_FEX_STATUS}"
+        "grok_pattern": "%{DATA:HOSTNAME} fault-engined\\: %{DATA:CISCO_UCS_STATUS_MSG}\\:\\[%{DATA:CISCO_UCS_EVENT_ID}\\]\\[%{DATA:CISCO_UCS_SEVERITY}\\]\\[%{DATA:CISCO_UCS_ERROR_MSG}\\]\\[%{DATA:CISCO_UCS_CHASIS_HW_LOCATION}\\] %{DATA:CISCO_UCS_SYSLOG_HW_MSG}\\:%{GREEDYDATA:CISCO_UCS_SYSLOG_HW_ERROR}"
       },
       "condition_type": "none",
       "condition_value": ""
     },
-    {
-      "title": "Cisco UCS IOM Module Status ",
-      "extractor_type": "grok",
-      "converters": [],
-      "order": 0,
-      "cursor_strategy": "copy",
-      "source_field": "message",
-      "target_field": "",
-      "extractor_config": {
-        "grok_pattern": "%{DATA:CISCO_FEX_MSG} %{DATA:CISCO_SAT_CTRL_MSG}\\: %{DATA:CISCO_IOM_ID} Module %{DATA:CISCO_IOM_Module}\\: %{GREEDYDATA:CISCO_IOM_MODULE_STATUS}"
-      },
-      "condition_type": "none",
-      "condition_value": ""
-    },
-    {
-      "title": "Cisco UCS Fault ",
+  {
+      "title": "Cisco UCS Error Messages",
       "extractor_type": "grok",
       "converters": [],
       "order": 0,
       "cursor_strategy": "copy",
       "source_field": "message",
       "target_field": "",
       "extractor_config": {
-        "grok_pattern": "%{DATA:CISCO_UCS_STATUS_MSG}\\: \\[%{DATA:CISCO_UCS_EVENT_ID}\\]\\[%{DATA:CISCO_UCS_SEVERITY}\\]\\[%{DATA:CISCO_UCS_ERROR_MSG}\\]\\[%{DATA:CISCO_UCS_CHASIS_HW_LOCATION}\\] %{DATA:CISCO_IOM_LOCATION} IOM %{DATA:CISCO_IOM_SLOT} \\(%{DATA:CISCO_UCS_FABRIC_ID}\\) is %{GREEDYDATA:CISCO_UCS_FABRIC_ASSESSIBILITY}"
+        "grok_pattern": "%UCSM-2-%{DATA:CISCO_UCS_STATUS_MSG}\\: \\[%{DATA:CISCO_UCS_EVENT_ID}\\]\\[%{DATA:CISCO_UCS_SEVERITY}\\]\\[%{DATA:CISCO_UCS_ERROR_MSG}\\]\\[%{DATA:CISCO_UCS_CHASIS_HW_LOCATION}\\] %{GREEDYDATA:CISCO_UCS_FULL_MSG}"
       },
       "condition_type": "none",
       "condition_value": ""
     },
     {
-      "title": "Cisco UCS FEX Status 2 ",
+      "title": "Cisco UCS CIMC Error 2 ",
       "extractor_type": "grok",
       "converters": [],
       "order": 0,
       "cursor_strategy": "copy",
       "source_field": "message",
       "target_field": "",
       "extractor_config": {
-        "grok_pattern": "%{DATA:CISCO_FEX_MSG}\\: %{DATA:CISCO_FEX_ID} %{DATA:CISCO_FEX_STATUS} \\(Serial Number %{GREEDYDATA:HARDWARE_SERIAL_NUMBER}\\)"
+        "grok_pattern": "\\: %{DATA:application_name}\\:%{DATA:process_id}\\: # %{GREEDYDATA:CIMC_CODE_1} \\# %{DATA:CIMC_CODE_2} %{DATE_US} %{TIME} \\| %{DATA:CIMC_APP_TYPE} \\| %{GREEDYDATA:CISCO_UCS_ERROR_MSG} \\#%{DATA:CIMC_APP_CODE} \\| %{DATA:CISCO_UCS_SYSLOG_HW_ERROR} \\| %{GREEDYDATA:CIMC_STATE}"
       },
       "condition_type": "none",
       "condition_value": ""
     },
     {
-      "title": "Cisco UCS FEX Status 3",
+      "title": "Cisco UCS CIMC Error 3",
       "extractor_type": "grok",
       "converters": [],
       "order": 0,
       "cursor_strategy": "copy",
       "source_field": "message",
       "target_field": "",
       "extractor_config": {
-        "grok_pattern": "%{DATA:CISCO_FEX_MSG}\\: Fex %{DATA:CISCO_FEX_ID} is %{DATA:CISCO_FEX_STATUS} \\(Serial number \\:%{DATA:HARDWARE_SERIAL_NUMBER}\\)"
+        "grok_pattern": "%{DATA:application_name}\\:%{DATA:process_id}\\: # %{GREEDYDATA:CIMC_CODE_1} \\# %{DATA:CIMC_CODE_2} %{DATE_US} %{TIME} UTC \\| %{DATA:CIMC_APP_TYPE} \\| %{GREEDYDATA:CISCO_UCS_ERROR_MSG} \\#%{DATA:CIMC_APP_CODE} \\| %{DATA:CISCO_UCS_SYSLOG_HW_ERROR} \\| %{GREEDYDATA:CIMC_STATE}"
       },
       "condition_type": "none",
       "condition_value": ""
     },
-    {
-      "title": "Cisco UCS Error Messages",
+     {
+      "title": "Cisco UCS Error Message 2",
       "extractor_type": "grok",
       "converters": [],
       "order": 0,
       "cursor_strategy": "copy",
       "source_field": "message",
       "target_field": "",
       "extractor_config": {
-        "grok_pattern": "%UCSM-2-%{DATA:CISCO_UCS_STATUS_MSG}\\: \\[%{DATA:CISCO_UCS_EVENT_ID}\\]\\[%{DATA:CISCO_UCS_SEVERITY}\\]\\[%{DATA:CISCO_UCS_ERROR_MSG}\\]\\[%{DATA:CISCO_UCS_CHASIS_HW_LOCATION}\\] %{GREEDYDATA:CISCO_UCS_FULL_MSG}"
+        "grok_pattern": "%UCSM-3-%{GREEDYDATA:CISCO_UCS_STATUS_MSG}\\: \\[%{DATA:CISCO_UCS_EVENT_ID}\\]\\[%{DATA:CISCO_UCS_SEVERITY}\\]\\[%{DATA:CISCO_UCS_ERROR_MSG}\\]\\[%{DATA:CISCO_UCS_CHASIS_HW_LOCATION}\\] %{GREEDYDATA:CISCO_UCS_FULL_MSG}"
       },
       "condition_type": "none",
       "condition_value": ""
     },
     {
-      "title": "Cisco UCS Authentication",
+      "title": "UCS Error Message 4",
       "extractor_type": "grok",
       "converters": [],
       "order": 0,
       "cursor_strategy": "copy",
       "source_field": "message",
       "target_field": "",
       "extractor_config": {
-        "grok_pattern": "%{DATA:CISCO_UCS_STATUS_MSG}:\\ %{DATA:Cisco_UCS_Auth_Code} %{DATA:Cisco_UCS_Auth_status} for User  - %{GREEDYDATA:username}"
+        "grok_pattern": "%UCSM-4-%{GREEDYDATA:CISCO_UCS_STATUS_MSG}\\: \\[%{DATA:CISCO_UCS_EVENT_ID}\\]\\[%{DATA:CISCO_UCS_SEVERITY}\\]\\[%{DATA:CISCO_UCS_ERROR_MSG}\\]\\[%{DATA:CISCO_UCS_CHASIS_HW_LOCATION}\\] %{GREEDYDATA:CISCO_UCS_FULL_MSG}"
       },
       "condition_type": "none",
       "condition_value": ""