Struggling to Parse a ciscoasa message

[david_waugh]

Hello

Im struggling to parse the following ciscoasa message with the ESI tool.

Oct 14 21:42:26 172.19.46.1 :%ASA-svc-4-722037: Group User IP <1.2.3.4> SVC closing connection: Transport closing.

I can define the header in the ESI 1.2.1 tool but it subsquently fails to match the header.

Playing around I think the problem is the colon follow directly by the percent character. (:%)

Can anyone help?

[NaushadKasu1]

Can you paste your HEADER and MESSAGE so we can see what is not working for you?

[david_waugh]

It looks to be a problem with the ESI tool. When I placed the parser that was created in the tool on a test system the message parsed as intended.

[NaushadKasu1]

Please report the issue with screenshots and examples as a support case so we can open a ticket with the content team engineering this tool.  Thank you -- glad the message is parsing.

[EricPartington]

is your ESI tool the same one from here ?

https://community.rsa.com/community/products/netwitness/blog/2017/04/24/rsa-netwitness-esi-10-beta-3 

or an older version of the ESI  tool?