custom cisco syslog to cef format

@cadrian90 Welcome to the Cloudera Community!

To help you get the best possible solution, I have tagged our NiFi experts @SAMSAL @MattWho  who may be able to assist you further.

Please keep us updated on your post, and we hope you find a satisfactory solution to your query.

@cadrian90 

I agree with @SAMSAL response.  Typically the ConvertRecord processor is what would be used here.  The processor support numerous record readers and numerous record writers.  The GrokReader is what would be commonly used to parse unstructured data like your Cisco syslog messages.  While the GrokReader has bulit in pattern file, you may fond yourself needing to define a custom pattern file for your specific data.  You might find this other community post helpful here:
https://community.cloudera.com/t5/Support-Questions/ExtractGrok-processor-Writing-Regex-to-parse-Cisco-syslog/td-p/233095

Beyond above, this is where it becomes challenging since Apache NiFi only has a CEFReader and no CEFRecordSetWriter (perhaps you can raise an Apache Jira asking for this new reader and someone in the Apache community may be able to help)

There does exist a ScriptedRecordSetWriter that if you know how to scripted out the CEF format, maybe you can use that.  I really would not be able to help there myself.
Maybe you can look into the CSVRecordSetWriter to see if selecting a custom format would facilitate an output like CEF.  Again not something I have tried myself.

Hope this helps you with your use case journey.

Please help our community thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

@cadrian90 Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.  Thanks.