diff --git a/packages/hpe_aruba_cx/_dev/build/docs/README.md b/packages/hpe_aruba_cx/_dev/build/docs/README.md index 553860b2797..eaf7d4466b1 100644 --- a/packages/hpe_aruba_cx/_dev/build/docs/README.md +++ b/packages/hpe_aruba_cx/_dev/build/docs/README.md @@ -924,7 +924,7 @@ Note: Descriptions have not been filled out | ``| aruba.mpls.local_ldp_id | | `` | aruba.mpls.peer_ldp_id | -#### [MSDP events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/MSDP.htm) +#### [MSDP events](https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MSDP.htm) | Docs Field | Schema Mapping | |---------------|------------------------------| | `` | aruba.msdp.grp_ip | @@ -938,6 +938,34 @@ Note: Descriptions have not been filled out | ``| aruba.msdp.tcp_entity | | `` | aruba.vrf.name | +#### [Message Session Relay Protocol events](https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MSRP.htm) +| Docs Field | Schema Mapping | +|--------------|----------------------| +| ``| aruba.msrp.decl_type | +| `` | aruba.port | +| `` | aruba.port | +| `` | event.reason | +| `` | aruba.status | +| `` | aruba.instance.id | + +#### [Multicast HelperD events](https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MULTICAST.htm) +| Docs Field | Schema Mapping | +|-----------------------|-----------------------------------| +| `` | aruba.multicast.encap_type | +| `` | aruba.multicast.flood_group_ip | +| `` | aruba.multicast.flood_group_range | +| `` | aruba.state | +| `` | aruba.multicast.ip_assign_method | +| `` | aruba.multicast.isl_rule | +| `` | aruba.state | +| `` | aruba.multicast.override_group_ip | +| `` | aruba.multicast.rep_mode | +| `` | aruba.state | +| `` | aruba.status | +| `` | aruba.multicast.ulay_l2_port | +| `` | aruba.multicast.ulay_l3_port | +| `` | aruba.multicast.vni_id | + #### [Multicast Traffic Manager events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/MTM.htm) | Docs Field | Schema Mapping | |--------------|----------------| diff --git a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log index 8315d71fd3b..72d99b1ced8 100644 --- a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log +++ b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log @@ -1049,6 +1049,7 @@ 2024-06-18T12:50:38.182641-05:00 8360-Primaire hpe-msdp[1234]: Event|8607|LOG_INFO|MSDP|-|Start server role for MSDP peer 192.168.1.1 2024-06-18T12:51:38.182641-05:00 8360-Primaire hpe-msdp[1234]: Event|8608|LOG_INFO|MSDP|-|Finish packet was received on MSDP Peer 192.168.1.1 2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-msdp[1234]: Event|8609|LOG_WARN|MSDP|-|Failed to add SA Cache entry: S=192.168.1.1, G=224.0.0.1, R=192.168.1.2 for Peer 192.168.1.3 as MSDP SA Cache Limit is reached +2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-msdp[1234]: Event|8610|LOG_INFO|MSDP|-|Hold timer expired for MSDP peer 192.168.1.1 on VRF default 2024-06-18T12:45:38.182641-05:00 8360-Primaire ztp[1234]: Event|8701|LOG_INFO|ZTP|-|ZTP service has started 2024-06-18T12:46:38.182641-05:00 8360-Primaire ztp[1234]: Event|8702|LOG_INFO|ZTP|-|ZTP service has stopped 2024-06-18T12:47:38.182641-05:00 8360-Primaire ztp[1234]: Event|8703|LOG_INFO|ZTP|-|ZTP service status changed to in-progress @@ -1549,6 +1550,31 @@ 2024-06-18T12:48:38.182641-05:00 8360-Primaire pimd[1234]: Event|15304|LOG_INFO|PIM|-|PIM Bidi enabled on Interface eth1 2024-06-18T12:49:38.182641-05:00 8360-Primaire pimd[1234]: Event|15305|LOG_INFO|PIM|-|PIM Bidi Neighbor 192.168.1.1 is up on Interface eth2 2024-06-18T12:50:38.182641-05:00 8360-Primaire pimd[1234]: Event|15306|LOG_ERR|PIM|-|PIM Bidi Neighbor 192.168.1.2 is down on Interface eth3 +2024-06-18T12:45:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15501|LOG_INFO|MSRP|-|MSRP stream 12345 created on port eth0 +2024-06-18T12:46:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15502|LOG_INFO|MSRP|-|MSRP stream 12345 deleted +2024-06-18T12:47:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15503|LOG_INFO|MSRP|-|MSRP is active on port eth0 +2024-06-18T12:48:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15504|LOG_WARN|MSRP|-|MSRP is inactive on port eth0 due to link_down +2024-06-18T12:49:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15505|LOG_INFO|MSRP|-|MSRP Stream 12345 Talker has left +2024-06-18T12:50:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15506|LOG_INFO|MSRP|-|MSRP Stream 12345 Listener connected on port eth0 has left +2024-06-18T12:51:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15507|LOG_INFO|MSRP|-|Resource allocation status for stream 12345 on port eth0 is success +2024-06-18T12:52:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15508|LOG_INFO|MSRP|-|Resource de-allocated for stream 12345 on port eth0 +2024-06-18T12:53:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15509|LOG_INFO|MSRP|-|Resource allocation requested for stream 12345 on port eth0 +2024-06-18T12:54:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15510|LOG_WARN|MSRP|-|Resource de-allocation requested for stream 12345 on port eth0 due to bandwidth_limit +2024-06-18T12:45:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15511|LOG_INFO|MSRP|-|MSRP Listener added with declaration-type talker for stream 12345 on port eth0 +2024-06-18T12:46:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15512|LOG_INFO|MSRP|-|MSRP Listener declaration-type changed to listener for stream 12345 on port eth0 2024-06-18T12:45:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15801|LOG_INFO|INJECTEDVIEWS|-|Injected view example_view was loaded 2024-06-18T12:46:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15802|LOG_INFO|INJECTEDVIEWS|-|Injected view example_view was unloaded 2024-06-18T12:47:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15803|LOG_ERR|INJECTEDVIEWS|-|Injected view example_view is in a failed state +2024-06-18T12:45:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15901|LOG_INFO|MULTICASTHELPERD|-|replication vxlan replication mode is enabled +2024-06-18T12:46:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15902|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication flood group range is set to 239.0.0.0/8 +2024-06-18T12:47:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15903|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication for vni 100 flood group ip is set to 239.1.1.1 via static +2024-06-18T12:48:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15904|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre pim_bidir state for flood group 239.1.1.1 is up +2024-06-18T12:49:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15905|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre pim_bidir underlay l3 port for flood group 239.1.1.1 is set to 1/1/1 +2024-06-18T12:50:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15906|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel encapsulation underlay l2 port for flood group 239.1.1.1 is set to 1/1/2 +2024-06-18T12:51:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15907|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre hardware status for flood group 239.1.1.1 is active +2024-06-18T12:52:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15908|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel encapsulation isl forwarding rule for flood group 239.1.1.1 is set to rule1 +2024-06-18T12:53:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15909|LOG_ERR|MULTICASTHELPERD|-|Error while changing the replication mode to enabled +2024-06-18T12:54:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15910|LOG_ERR|MULTICASTHELPERD|-|Underlay-multicast flood group range given 239.0.0.0/8 is invalid +2024-06-18T12:45:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15911|LOG_ERR|MULTICASTHELPERD|-|Underlay-multicast flood group ip 239.1.1.1 is invalid +2024-06-18T12:46:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15912|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre operational state for flood group 239.1.1.1 is up +2024-06-18T12:47:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15913|LOG_ERR|MULTICASTHELPERD|-|Resource exhausted for underlay multicast vxlan replication for override group ip 239.1.1.2 \ No newline at end of file diff --git a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json index c68e60cf5ed..29136661264 100644 --- a/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json +++ b/packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-fabricated.log-expected.json @@ -39485,6 +39485,45 @@ "preserve_original_event" ] }, + { + "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "aruba": { + "component": { + "category": "MSDP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "vrf": { + "name": "default" + } + }, + "client": { + "ip": "192.168.1.1" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "8610", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire hpe-msdp[1234]: Event|8610|LOG_INFO|MSDP|-|Hold timer expired for MSDP peer 192.168.1.1 on VRF default" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "hpe-msdp", + "procid": "1234" + } + }, + "message": "Hold timer expired for MSDP peer 192.168.1.1 on VRF default", + "tags": [ + "preserve_original_event" + ] + }, { "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { @@ -58079,15 +58118,16 @@ "@timestamp": "2024-06-18T12:45:38.182641-05:00", "aruba": { "component": { - "category": "INJECTEDVIEWS" + "category": "MSRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "injected_view": { - "name": "example_view" - } + "instance": { + "id": "12345" + }, + "port": "eth0" }, "ecs": { "version": "8.11.0" @@ -58096,17 +58136,17 @@ "category": [ "network" ], - "code": "15801", - "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15801|LOG_INFO|INJECTEDVIEWS|-|Injected view example_view was loaded" + "code": "15501", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15501|LOG_INFO|MSRP|-|MSRP stream 12345 created on port eth0" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "injectedviewd", + "appname": "msrpd", "procid": "1234" } }, - "message": "Injected view example_view was loaded", + "message": "MSRP stream 12345 created on port eth0", "tags": [ "preserve_original_event" ] @@ -58115,14 +58155,14 @@ "@timestamp": "2024-06-18T12:46:38.182641-05:00", "aruba": { "component": { - "category": "INJECTEDVIEWS" + "category": "MSRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "injected_view": { - "name": "example_view" + "instance": { + "id": "12345" } }, "ecs": { @@ -58132,17 +58172,17 @@ "category": [ "network" ], - "code": "15802", - "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15802|LOG_INFO|INJECTEDVIEWS|-|Injected view example_view was unloaded" + "code": "15502", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15502|LOG_INFO|MSRP|-|MSRP stream 12345 deleted" }, "log": { "level": "LOG_INFO", "syslog": { - "appname": "injectedviewd", + "appname": "msrpd", "procid": "1234" } }, - "message": "Injected view example_view was unloaded", + "message": "MSRP stream 12345 deleted", "tags": [ "preserve_original_event" ] @@ -58151,16 +58191,49 @@ "@timestamp": "2024-06-18T12:47:38.182641-05:00", "aruba": { "component": { - "category": "INJECTEDVIEWS" + "category": "MSRP" }, "event_type": "Event", "hardware": { "device": "8360-Primaire" }, - "injected_view": { - "name": "example_view" + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15503", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15503|LOG_INFO|MSRP|-|MSRP is active on port eth0" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" } }, + "message": "MSRP is active on port eth0", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "port": "eth0", + "status": "link_down" + }, "ecs": { "version": "8.11.0" }, @@ -58168,17 +58241,909 @@ "category": [ "network" ], - "code": "15803", - "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15803|LOG_ERR|INJECTEDVIEWS|-|Injected view example_view is in a failed state" + "code": "15504", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15504|LOG_WARN|MSRP|-|MSRP is inactive on port eth0 due to link_down" }, "log": { - "level": "LOG_ERR", + "level": "LOG_WARN", "syslog": { - "appname": "injectedviewd", + "appname": "msrpd", "procid": "1234" } }, - "message": "Injected view example_view is in a failed state", + "message": "MSRP is inactive on port eth0 due to link_down", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15505", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15505|LOG_INFO|MSRP|-|MSRP Stream 12345 Talker has left" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "MSRP Stream 12345 Talker has left", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + }, + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15506", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15506|LOG_INFO|MSRP|-|MSRP Stream 12345 Listener connected on port eth0 has left" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "MSRP Stream 12345 Listener connected on port eth0 has left", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + }, + "port": "eth0", + "status": "success" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15507", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15507|LOG_INFO|MSRP|-|Resource allocation status for stream 12345 on port eth0 is success" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "Resource allocation status for stream 12345 on port eth0 is success", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + }, + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15508", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15508|LOG_INFO|MSRP|-|Resource de-allocated for stream 12345 on port eth0" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "Resource de-allocated for stream 12345 on port eth0", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + }, + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15509", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15509|LOG_INFO|MSRP|-|Resource allocation requested for stream 12345 on port eth0" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "Resource allocation requested for stream 12345 on port eth0", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + }, + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15510", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15510|LOG_WARN|MSRP|-|Resource de-allocation requested for stream 12345 on port eth0 due to bandwidth_limit", + "reason": "bandwidth_limit" + }, + "log": { + "level": "LOG_WARN", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "Resource de-allocation requested for stream 12345 on port eth0 due to bandwidth_limit", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + }, + "msrp": { + "decl_type": "talker" + }, + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15511", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15511|LOG_INFO|MSRP|-|MSRP Listener added with declaration-type talker for stream 12345 on port eth0" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "MSRP Listener added with declaration-type talker for stream 12345 on port eth0", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "MSRP" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "instance": { + "id": "12345" + }, + "msrp": { + "decl_type": "listener" + }, + "port": "eth0" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15512", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire msrpd[1234]: Event|15512|LOG_INFO|MSRP|-|MSRP Listener declaration-type changed to listener for stream 12345 on port eth0" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "msrpd", + "procid": "1234" + } + }, + "message": "MSRP Listener declaration-type changed to listener for stream 12345 on port eth0", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "INJECTEDVIEWS" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "injected_view": { + "name": "example_view" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15801", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15801|LOG_INFO|INJECTEDVIEWS|-|Injected view example_view was loaded" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "injectedviewd", + "procid": "1234" + } + }, + "message": "Injected view example_view was loaded", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "INJECTEDVIEWS" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "injected_view": { + "name": "example_view" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15802", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15802|LOG_INFO|INJECTEDVIEWS|-|Injected view example_view was unloaded" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "injectedviewd", + "procid": "1234" + } + }, + "message": "Injected view example_view was unloaded", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "INJECTEDVIEWS" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "injected_view": { + "name": "example_view" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15803", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire injectedviewd[1234]: Event|15803|LOG_ERR|INJECTEDVIEWS|-|Injected view example_view is in a failed state" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "injectedviewd", + "procid": "1234" + } + }, + "message": "Injected view example_view is in a failed state", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "rep_mode": "replication" + }, + "status": "enabled" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15901", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15901|LOG_INFO|MULTICASTHELPERD|-|replication vxlan replication mode is enabled" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "replication vxlan replication mode is enabled", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "flood_group_range": "239.0.0.0/8" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15902", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15902|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication flood group range is set to 239.0.0.0/8" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication flood group range is set to 239.0.0.0/8", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "flood_group_ip": "239.1.1.1", + "ip_assign_method": "static", + "vni_id": "100" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15903", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15903|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication for vni 100 flood group ip is set to 239.1.1.1 via static" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication for vni 100 flood group ip is set to 239.1.1.1 via static", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:48:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "encap_type": "gre", + "flood_group_ip": "239.1.1.1" + }, + "state": "up" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15904", + "original": "2024-06-18T12:48:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15904|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre pim_bidir state for flood group 239.1.1.1 is up" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication tunnel gre pim_bidir state for flood group 239.1.1.1 is up", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:49:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "encap_type": "gre", + "flood_group_ip": "239.1.1.1", + "ulay_l3_port": "1/1/1" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15905", + "original": "2024-06-18T12:49:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15905|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre pim_bidir underlay l3 port for flood group 239.1.1.1 is set to 1/1/1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication tunnel gre pim_bidir underlay l3 port for flood group 239.1.1.1 is set to 1/1/1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:50:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "flood_group_ip": "239.1.1.1", + "ulay_l2_port": "1/1/2" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15906", + "original": "2024-06-18T12:50:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15906|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel encapsulation underlay l2 port for flood group 239.1.1.1 is set to 1/1/2" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication tunnel encapsulation underlay l2 port for flood group 239.1.1.1 is set to 1/1/2", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:51:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "encap_type": "gre", + "flood_group_ip": "239.1.1.1" + }, + "state": "active" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15907", + "original": "2024-06-18T12:51:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15907|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre hardware status for flood group 239.1.1.1 is active" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication tunnel gre hardware status for flood group 239.1.1.1 is active", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:52:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "flood_group_ip": "239.1.1.1", + "isl_rule": "rule1" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15908", + "original": "2024-06-18T12:52:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15908|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel encapsulation isl forwarding rule for flood group 239.1.1.1 is set to rule1" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication tunnel encapsulation isl forwarding rule for flood group 239.1.1.1 is set to rule1", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:53:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "rep_mode": "enabled" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15909", + "original": "2024-06-18T12:53:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15909|LOG_ERR|MULTICASTHELPERD|-|Error while changing the replication mode to enabled" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Error while changing the replication mode to enabled", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:54:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "flood_group_range": "239.0.0.0/8" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15910", + "original": "2024-06-18T12:54:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15910|LOG_ERR|MULTICASTHELPERD|-|Underlay-multicast flood group range given 239.0.0.0/8 is invalid" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay-multicast flood group range given 239.0.0.0/8 is invalid", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:45:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "flood_group_ip": "239.1.1.1" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15911", + "original": "2024-06-18T12:45:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15911|LOG_ERR|MULTICASTHELPERD|-|Underlay-multicast flood group ip 239.1.1.1 is invalid" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay-multicast flood group ip 239.1.1.1 is invalid", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:46:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "encap_type": "gre", + "flood_group_ip": "239.1.1.1" + }, + "state": "up" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15912", + "original": "2024-06-18T12:46:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15912|LOG_INFO|MULTICASTHELPERD|-|Underlay multicast vxlan replication tunnel gre operational state for flood group 239.1.1.1 is up" + }, + "log": { + "level": "LOG_INFO", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Underlay multicast vxlan replication tunnel gre operational state for flood group 239.1.1.1 is up", + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2024-06-18T12:47:38.182641-05:00", + "aruba": { + "component": { + "category": "MULTICASTHELPERD" + }, + "event_type": "Event", + "hardware": { + "device": "8360-Primaire" + }, + "multicast": { + "override_group_ip": "239.1.1.2" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "network" + ], + "code": "15913", + "original": "2024-06-18T12:47:38.182641-05:00 8360-Primaire multicastd[1234]: Event|15913|LOG_ERR|MULTICASTHELPERD|-|Resource exhausted for underlay multicast vxlan replication for override group ip 239.1.1.2" + }, + "log": { + "level": "LOG_ERR", + "syslog": { + "appname": "multicastd", + "procid": "1234" + } + }, + "message": "Resource exhausted for underlay multicast vxlan replication for override group ip 239.1.1.2", "tags": [ "preserve_original_event" ] diff --git a/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 32b874aa9af..6e68070f67c 100644 --- a/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3599,11 +3599,11 @@ processors: if: "ctx.event?.code == '8515'" pattern: "Operational state of the ring %{aruba.erps.ring_id}, instance %{aruba.instance.id} changed to Initializing with reason %{event.reason}" - # MSDP events (860x) - # https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/MSDP.htm + # MSDP events (86xx) + # https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MSDP.htm - grok: field: message - tag: msdp_event_8601_through_8609 + tag: msdp_event_8601_8602_8603_8604_8605_8606_8607_8608_8609 description: "The following are the events related to MSDP" if: "['8601','8602','8603','8604','8605','8606','8607','8608','8609'].contains(ctx.event?.code)" patterns: @@ -3615,6 +3615,12 @@ processors: - "^Start %{DATA:aruba.msdp.tcp_entity} role for MSDP peer %{IP:client.ip}" - "^Finish packet was received on MSDP Peer %{IP:client.ip}" - "^Failed to add SA Cache entry: S=%{IP:source.ip}, G=%{IP:aruba.msdp.grp_ip}, R=%{IP:aruba.msdp.rp_ip} for Peer %{IP:client.ip} as MSDP SA Cache Limit is reached" + - dissect: + field: message + tag: msdp_event_8610 + description: "Log event when MSDP peer hold timer expired" + if: "ctx.event?.code == '8610'" + pattern: "Hold timer expired for MSDP peer %{client.ip} on VRF %{aruba.vrf.name}" # Zero touch provisioning events (87xx) # https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/ZTPD.htm @@ -5290,16 +5296,143 @@ processors: patterns: - "^PIM Bidi Neighbor %{IP:client.ip} is %{DATA:aruba.state} on Interface %{GREEDYDATA:aruba.interface.name}" + # Message Session Relay Protocol events (155xx) + # https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MSRP.htm + - grok: + field: message + tag: msrp_event_15501_15502 + description: "Event reported when MSRP stream is [created|deleted]" + if: "['15501','15502'].contains(ctx.event?.code)" + patterns: + - "^MSRP stream %{DATA:aruba.instance.id} (created on port %{GREEDYDATA:aruba.port}|deleted)" + - grok: + field: message + tag: msrp_event_15503_15504 + description: "Event reported when MSRP becomes [active|inactive] on port" + if: "['15503','15504'].contains(ctx.event?.code)" + patterns: + - "^MSRP is active on port %{GREEDYDATA:aruba.port}" + - "^MSRP is inactive on port %{DATA:aruba.port} due to %{GREEDYDATA:aruba.status}" + - grok: + field: message + tag: msrp_event_15505_15506 + description: "Event reported when MSRP [Talker|Listener] leave" + if: "['15505','15506'].contains(ctx.event?.code)" + patterns: + - "^MSRP Stream %{DATA:aruba.instance.id} (Talker has left|Listener connected on port %{DATA:aruba.port} has left)" + - dissect: + field: message + tag: msrp_event_15507 + description: "Event reported when resource allocation status is updated for an MSRP stream" + if: "ctx.event?.code == '15507'" + pattern: "Resource allocation status for stream %{aruba.instance.id} on port %{aruba.port} is %{aruba.status}" + - grok: + field: message + tag: msrp_event_15508_15509 + description: "Event reported when resource de allocated for an MSRP stream | Event reported when resource allocation requested for an MSRP stream" + if: "['15508','15509'].contains(ctx.event?.code)" + patterns: + - "^Resource (de-allocated|allocation requested) for stream %{DATA:aruba.instance.id} on port %{GREEDYDATA:aruba.port}" + - dissect: + field: message + tag: msrp_event_15510 + description: "Event reported when resource de alloc requested for an MSRP stream" + if: "ctx.event?.code == '15510'" + pattern: "Resource de-allocation requested for stream %{aruba.instance.id} on port %{aruba.port} due to %{event.reason}" + - grok: + field: message + tag: msrp_event_15511_15512 + description: "Event reported when listener gets added for an MSRP stream | Event reported when listener declaration-type changes for an MSRP stream" + if: "['15511','15512'].contains(ctx.event?.code)" + patterns: + - "^MSRP Listener (added with declaration-type|declaration-type changed to) %{DATA:aruba.msrp.decl_type} for stream %{DATA:aruba.instance.id} on port %{GREEDYDATA:aruba.port}" + # Injected Views (1580x) # https://www.arubanetworks.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/INJECTED-VIEWS.htm - grok: field: message - tag: injected_view_event_15801 - description: "Event reported when an injected view is loaded|unloaded|in failed state " + tag: injected_view_event_15801_15802_15803 + description: "Event reported when an injected view is loaded|unloaded|in failed state" if: "['15801','15802','15803'].contains(ctx.event?.code)" patterns: - "^Injected view %{DATA:aruba.injected_view.name} " + # Multicast HelperD events (159xx) + # https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MULTICAST.htm + - dissect: + field: message + tag: multicast_helperd_event_15901 + description: "Event raised when vxlan replication mode is configured or applied" + if: "ctx.event?.code == '15901'" + pattern: "%{aruba.multicast.rep_mode} vxlan replication mode is %{aruba.status}" + - dissect: + field: message + tag: multicast_helperd_event_15902 + description: "Event raised when underlay multicast vxlan replication flood group range is set" + if: "ctx.event?.code == '15902'" + pattern: "Underlay multicast vxlan replication flood group range is set to %{aruba.multicast.flood_group_range}" + - dissect: + field: message + tag: multicast_helperd_event_15903 + description: "Event raised when underlay multicast vxlan replication flood group ip is set" + if: "ctx.event?.code == '15903'" + pattern: "Underlay multicast vxlan replication for vni %{aruba.multicast.vni_id} flood group ip is set to %{aruba.multicast.flood_group_ip} via %{aruba.multicast.ip_assign_method}" + - grok: + field: message + tag: multicast_helperd_event_15904_15907 + description: "Event raised when underlay multicast vxlan replication tunnel pim bidir state changes | hardware status is updated" + if: "['15904','15907'].contains(ctx.event?.code)" + patterns: + - "^Underlay multicast vxlan replication tunnel %{DATA:aruba.multicast.encap_type} (pim_bidir state|hardware status) for flood group %{IP:aruba.multicast.flood_group_ip} is %{GREEDYDATA:aruba.state}" + - dissect: + field: message + tag: multicast_helperd_event_15905 + description: "Event raised when underlay multicast vxlan replication tunnel pim bidir underlay l3 port is updated" + if: "ctx.event?.code == '15905'" + pattern: "Underlay multicast vxlan replication tunnel %{aruba.multicast.encap_type} pim_bidir underlay l3 port for flood group %{aruba.multicast.flood_group_ip} is set to %{aruba.multicast.ulay_l3_port}" + - dissect: + field: message + tag: multicast_helperd_event_15906 + description: "Event raised when underlay multicast vxlan replication tunnel underlay l2 port is updated" + if: "ctx.event?.code == '15906'" + pattern: "Underlay multicast vxlan replication tunnel encapsulation underlay l2 port for flood group %{aruba.multicast.flood_group_ip} is set to %{aruba.multicast.ulay_l2_port}" + - dissect: + field: message + tag: multicast_helperd_event_15908 + description: "Event raised when underlay multicast vxlan replication tunnel encap isl forwarding rule is updated" + if: "ctx.event?.code == '15908'" + pattern: "Underlay multicast vxlan replication tunnel encapsulation isl forwarding rule for flood group %{aruba.multicast.flood_group_ip} is set to %{aruba.multicast.isl_rule}" + - dissect: + field: message + tag: multicast_helperd_event_15909 + description: "Event raised when error occurs while changing the vxlan replication mode" + if: "ctx.event?.code == '15909'" + pattern: "Error while changing the replication mode to %{aruba.multicast.rep_mode}" + - dissect: + field: message + tag: multicast_helperd_event_15910 + description: "Event raised when given flood group range for unerlay multicast vxlan replication mode is invalid" + if: "ctx.event?.code == '15910'" + pattern: "Underlay-multicast flood group range given %{aruba.multicast.flood_group_range} is invalid" + - dissect: + field: message + tag: multicast_helperd_event_15911 + description: "Event raised when given flood group ip for unerlay multicast vxlan replication is invalid" + if: "ctx.event?.code == '15911'" + pattern: "Underlay-multicast flood group ip %{aruba.multicast.flood_group_ip} is invalid" + - dissect: + field: message + tag: multicast_helperd_event_15912 + description: "Event raised when underlay multicast vxlan replication tunnel operational state is updated" + if: "ctx.event?.code == '15912'" + pattern: "Underlay multicast vxlan replication tunnel %{aruba.multicast.encap_type} operational state for flood group %{aruba.multicast.flood_group_ip} is %{aruba.state}" + - dissect: + field: message + tag: multicast_helperd_event_15913 + description: "Event raised when resource exhausted for underlay multicast vxlan replication" + if: "ctx.event?.code == '15913'" + pattern: "Resource exhausted for underlay multicast vxlan replication for override group ip %{aruba.multicast.override_group_ip}" + # Cleanup MAC addresses for different fields - uppercase: field: client.mac diff --git a/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml b/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml index b0bac39df34..79f30e1036a 100644 --- a/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml +++ b/packages/hpe_aruba_cx/data_stream/log/fields/fields.yml @@ -948,6 +948,12 @@ - name: rp_ip type: ip description: "" + - name: msrp + type: group + fields: + - name: decl_type + type: keyword + description: "" - name: mstp type: group fields: @@ -987,6 +993,39 @@ - name: mtu type: keyword description: "" + - name: multicast + type: group + fields: + - name: encap_type + type: keyword + description: "" + - name: flood_group_ip + type: ip + description: "" + - name: flood_group_range + type: keyword + description: "" + - name: ip_assign_method + type: keyword + description: "" + - name: isl_rule + type: keyword + description: "" + - name: override_group_ip + type: keyword + description: "" + - name: rep_mode + type: keyword + description: "" + - name: ulay_l2_port + type: keyword + description: "" + - name: ulay_l3_port + type: keyword + description: "" + - name: vni_id + type: keyword + description: "" - name: nae type: group fields: diff --git a/packages/hpe_aruba_cx/docs/README.md b/packages/hpe_aruba_cx/docs/README.md index 4cba7cd801c..bc461d76ab2 100644 --- a/packages/hpe_aruba_cx/docs/README.md +++ b/packages/hpe_aruba_cx/docs/README.md @@ -924,7 +924,7 @@ Note: Descriptions have not been filled out | ``| aruba.mpls.local_ldp_id | | `` | aruba.mpls.peer_ldp_id | -#### [MSDP events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/MSDP.htm) +#### [MSDP events](https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MSDP.htm) | Docs Field | Schema Mapping | |---------------|------------------------------| | `` | aruba.msdp.grp_ip | @@ -938,6 +938,34 @@ Note: Descriptions have not been filled out | ``| aruba.msdp.tcp_entity | | `` | aruba.vrf.name | +#### [Message Session Relay Protocol events](https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MSRP.htm) +| Docs Field | Schema Mapping | +|--------------|----------------------| +| ``| aruba.msrp.decl_type | +| `` | aruba.port | +| `` | aruba.port | +| `` | event.reason | +| `` | aruba.status | +| `` | aruba.instance.id | + +#### [Multicast HelperD events](https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/elmrg/Content/events/MULTICAST.htm) +| Docs Field | Schema Mapping | +|-----------------------|-----------------------------------| +| `` | aruba.multicast.encap_type | +| `` | aruba.multicast.flood_group_ip | +| `` | aruba.multicast.flood_group_range | +| `` | aruba.state | +| `` | aruba.multicast.ip_assign_method | +| `` | aruba.multicast.isl_rule | +| `` | aruba.state | +| `` | aruba.multicast.override_group_ip | +| `` | aruba.multicast.rep_mode | +| `` | aruba.state | +| `` | aruba.status | +| `` | aruba.multicast.ulay_l2_port | +| `` | aruba.multicast.ulay_l3_port | +| `` | aruba.multicast.vni_id | + #### [Multicast Traffic Manager events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/MTM.htm) | Docs Field | Schema Mapping | |--------------|----------------| @@ -1964,6 +1992,7 @@ The `log` dataset collects the HPE Aruba CX logs. | aruba.msdp.grp_ip | | ip | | aruba.msdp.rp_ip | | ip | | aruba.msdp.tcp_entity | | keyword | +| aruba.msrp.decl_type | | keyword | | aruba.mstp.config_parameter | | keyword | | aruba.mstp.config_value | | keyword | | aruba.mstp.new_mode | | keyword | @@ -1976,6 +2005,16 @@ The `log` dataset collects the HPE Aruba CX logs. | aruba.mstp.proto | | keyword | | aruba.mstp.reconfig_parameter | | keyword | | aruba.mtu | | keyword | +| aruba.multicast.encap_type | | keyword | +| aruba.multicast.flood_group_ip | | ip | +| aruba.multicast.flood_group_range | | keyword | +| aruba.multicast.ip_assign_method | | keyword | +| aruba.multicast.isl_rule | | keyword | +| aruba.multicast.override_group_ip | | keyword | +| aruba.multicast.rep_mode | | keyword | +| aruba.multicast.ulay_l2_port | | keyword | +| aruba.multicast.ulay_l3_port | | keyword | +| aruba.multicast.vni_id | | keyword | | aruba.nae.action_type | | keyword | | aruba.nae.condition | | keyword | | aruba.nae.description | | keyword |