Skip to:
https://github.com/elasticsearch/logstash/pull/1162 adds underscore to first part of CISCOTAG, which allows it to match some tags I encountered, eg. SW_MATM-4-MACFLAP_NOTIF
Moved to githubhttps://github.com/logstash-plugins/logstash-patterns-core/issues/19
https://github.com/elasticsearch/logstash/pull/1162
Waiting on PR.
https://github.com/elasticsearch/logstash/pull/1162 adds underscore to first part of CISCOTAG, which allows it to match some tags I encountered, eg. SW_MATM-4-MACFLAP_NOTIF