# \<13\> added to beginning of message

**URL:** <https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450>\
**Category:** Logstash\
**Created:** [April 18, 2018, 4:29am UTC](https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450 "2018-04-18T04:29:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![insomniac](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@insomniac](https://discuss.elastic.co/u/insomniac)\
**Post date:** [April 18, 2018, 4:29am UTC](https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450/1 "2018-04-18T04:29:39Z")

</div>

I have two very different inputs (syslog & exchange message tracking logs) coming from different servers going into different input/filter/output configs in logstash.

Both of these have \<13\> added to the start of each message when being ingested into logstash and i can't find where it's coming from.

Looking at the stdoutput of the logs, it's in the message when it reaches logstash.  
I haven't performed a tcpdump to see if it's in the actual message, that'll be the next step. But does anyone have any clue why this is being added?

I have a few other different inputs that don't get this added.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 18, 2018, 6:44am UTC](https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450/2 "2018-04-18T06:44:25Z")

</div>

The `<13>` is part of the syslog protocol and encodes the message's facility and severity.

---

<div class="post-metadata">

**Author:** ![insomniac](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@insomniac](https://discuss.elastic.co/u/insomniac)\
**Post date:** [April 19, 2018, 3:15am UTC](https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450/3 "2018-04-19T03:15:42Z")

</div>

Thanks. I came to the same conclusion shortly after posting as well.

The Exchange logs were shipped with nxlog which had to\_syslog\_bsd() in it's config. Removing this removed the \<13\>

And your info makes the syslog appearance almost 'to be expected'.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2018, 3:16am UTC](https://discuss.elastic.co/t/13-added-to-beginning-of-message/128450/4 "2018-05-17T03:16:17Z")

</div>

Closed on May 17, 2018, 3:16am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.