[ https://issues.apache.org/jira/browse/METRON-164?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Domenic Puzio updated METRON-164: --------------------------------- Description: Create a parser for the Aruba Clearpass telemetry source. Below are sample lines, parsed and parsed. <143>2016-04-29 04:27:31,817 120.44.205.9 CPPM_Session_Detail 473963971 1 0 id=5983678767,session_id=R011cf475-04-57231a94,type=AUTH_IN,attr_name=Authorization:[Insight Repository]:Minutes-Since-Auth,attr_value=82775,timestamp=2016-04-29 04:25:56.77251-04 ... {"request_timestamp":"2016-04-29 04:25:56.77251-04","attr_name":"Authorization:[Insight Repository]:Minutes-Since-Auth","session_id":"R011cf475-04-57231a94","message_type":"CPPM_Session_Detail","source.type":"aruba","type":"AUTH_IN","attr_value":"82775","original_string":"<143>2016-04-29 04:27:31,817 120.44.205.9 CPPM_Session_Detail 473963971 1 0 id=5983678767,session_id=R011cf475-04-57231a94,type=AUTH_IN,attr_name=Authorization:[Insight Repository]:Minutes-Since-Auth,attr_value=82775,timestamp=2016-04-29 04:25:56.77251-04","message_hex":"473963971",id":"5983678767","ip_src_addr":"120.44.205.9","timestamp":1461904051000} <143>2016-04-29 04:27:31,819 10.148.5.141 CPPM_Session_Detail 473964265 1 0 id=5983679060,session_id=R011cf47d-04-57231a9b,type=INTERNAL_IN,attr_name=Connection:SSID,attr_value= ,timestamp=2016-04-29 04:26:04.866339-04 ... {"request_timestamp":"2016-04-29 04:26:04.866339-04","attr_name":"Connection:SSID","session_id":"R011cf47d-04-57231a9b","message_type":"CPPM_Session_Detail","source.type":"aruba","type":"INTERNAL_IN","attr_value":" ","original_string":"<143>2016-04-29 04:27:31,819 10.148.5.141 CPPM_Session_Detail 473964265 1 0 id=5983679060,session_id=R011cf47d-04-57231a9b,type=INTERNAL_IN,attr_name=Connection:SSID,attr_value= ,timestamp=2016-04-29 04:26:04.866339-04","message_hex":"473964265","id":"5983679060","ip_src_addr":"10.148.5.141","timestamp":1461904051000} was: Create a parser for the Aruba Clearpass telemetry source. Below are sample lines, parsed and parsed. <143>2016-04-29 04:27:31,817 120.44.205.9 CPPM_Session_Detail 473963971 1 0 id=5983678767,session_id=R011cf475-04-57231a94,type=AUTH_IN,attr_name=Authorization:[Insight Repository]:Minutes-Since-Auth,attr_value=82775,timestamp=2016-04-29 04:25:56.77251-04 ... {"request_timestamp":"2016-04-29 04:25:56.77251-04","attr_name":"Authorization:[Insight Repository]:Minutes-Since-Auth","session_id":"R011cf475-04-57231a94","message_type":"CPPM_Session_Detail","source.type":"aruba","type":"AUTH_IN","attr_value":"82775","original_string":"<143>2016-04-29 04:27:31,817 120.44.205.9 CPPM_Session_Detail 473963971 1 0 id=5983678767,session_id=R011cf475-04-57231a94,type=AUTH_IN,attr_name=Authorization:[Insight Repository]:Minutes-Since-Auth,attr_value=82775,timestamp=2016-04-29 04:25:56.77251-04","message_hex":"473963971",id":"5983678767","ip_src_addr":"120.44.205.9","timestamp":1461904051000} <143>2016-04-29 04:27:31,819 10.148.5.141 CPPM_Session_Detail 473964265 1 0 id=5983679060,session_id=R011cf47d-04-57231a9b,type=INTERNAL_IN,attr_name=Connection:SSID,attr_value= ,timestamp=2016-04-29 04:26:04.866339-04 ... {"request_timestamp":"2016-04-29 04:26:04.866339-04","attr_name":"Connection:SSID","session_id":"R011cf47d-04-57231a9b","message_type":"CPPM_Session_Detail","source.type":"aruba","type":"INTERNAL_IN","attr_value":" ","original_string":"<143>2016-04-29 04:27:31,819 10.148.5.141 CPPM_Session_Detail 473964265 1 0 id=5983679060,session_id=R011cf47d-04-57231a9b,type=INTERNAL_IN,attr_name=Connection:SSID,attr_value= ,timestamp=2016-04-29 04:26:04.866339-04","message_hex":"473964265","id":"5983679060","ip_src_addr":"10.148.5.141","timestamp":1461904051000} > Create Aruba Clearpass Parser > ----------------------------- > > Key: METRON-164 > URL: https://issues.apache.org/jira/browse/METRON-164 > Project: Metron > Issue Type: Bug > Reporter: Domenic Puzio > Priority: Minor > > Create a parser for the Aruba Clearpass telemetry source. Below are sample > lines, parsed and parsed. > <143>2016-04-29 04:27:31,817 120.44.205.9 CPPM_Session_Detail 473963971 1 0 > id=5983678767,session_id=R011cf475-04-57231a94,type=AUTH_IN,attr_name=Authorization:[Insight > Repository]:Minutes-Since-Auth,attr_value=82775,timestamp=2016-04-29 > 04:25:56.77251-04 > ... > {"request_timestamp":"2016-04-29 > 04:25:56.77251-04","attr_name":"Authorization:[Insight > Repository]:Minutes-Since-Auth","session_id":"R011cf475-04-57231a94","message_type":"CPPM_Session_Detail","source.type":"aruba","type":"AUTH_IN","attr_value":"82775","original_string":"<143>2016-04-29 > 04:27:31,817 120.44.205.9 CPPM_Session_Detail 473963971 1 0 > id=5983678767,session_id=R011cf475-04-57231a94,type=AUTH_IN,attr_name=Authorization:[Insight > Repository]:Minutes-Since-Auth,attr_value=82775,timestamp=2016-04-29 > 04:25:56.77251-04","message_hex":"473963971",id":"5983678767","ip_src_addr":"120.44.205.9","timestamp":1461904051000} > <143>2016-04-29 04:27:31,819 10.148.5.141 CPPM_Session_Detail 473964265 1 0 > id=5983679060,session_id=R011cf47d-04-57231a9b,type=INTERNAL_IN,attr_name=Connection:SSID,attr_value= > ,timestamp=2016-04-29 04:26:04.866339-04 > ... > {"request_timestamp":"2016-04-29 > 04:26:04.866339-04","attr_name":"Connection:SSID","session_id":"R011cf47d-04-57231a9b","message_type":"CPPM_Session_Detail","source.type":"aruba","type":"INTERNAL_IN","attr_value":" > ","original_string":"<143>2016-04-29 04:27:31,819 10.148.5.141 > CPPM_Session_Detail 473964265 1 0 > id=5983679060,session_id=R011cf47d-04-57231a9b,type=INTERNAL_IN,attr_name=Connection:SSID,attr_value= > ,timestamp=2016-04-29 > 04:26:04.866339-04","message_hex":"473964265","id":"5983679060","ip_src_addr":"10.148.5.141","timestamp":1461904051000} -- This message was sent by Atlassian JIRA (v6.3.4#6332)