# Can't parse event as syslog rfc3164 **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 1, 2024, 2:53pm UTC](https://discuss.elastic.co/t/cant-parse-event-as-syslog-rfc3164/352307 "2024-02-01T14:53:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Amol\_Sahare](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amol_sahare/32/122260_2.png) [@Amol\_Sahare](https://discuss.elastic.co/u/Amol_Sahare)\ **Post date:** [February 1, 2024, 2:53pm UTC](https://discuss.elastic.co/t/cant-parse-event-as-syslog-rfc3164/352307/1 "2024-02-01T14:53:49Z")
Hello, We are having problems with the'syslog' input of filebeat. I'm using the script for sending a single log to the filebeat syslog input. I've noticed that the same message is being parsed because I can see the event on my logger server, and I've also noticed errors being sent to the log file, resulting in the loss of many logs. ![Logger](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e78880dd51fede53799ddfd00cf3c0481e78c7f.jpeg) Single Log: ```auto Jan 24 2024 11:22:41 : %FTD-6-430003: EventPriority: Low, DeviceUUID: 70278058-1b77-11ec-a090-feeeb3702f49, InstanceID: 4, FirstPacketSecond: 2024-01-24T11:21:03Z, ConnectionID: 40428, AccessControlRuleAction: Allow, SrcIP: 0.0.0.0, DstIP: 92.204.128.155, SrcPort: 62416, DstPort: 4433, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: inside, EgressZone: outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: Pol_Access_Control, AccessControlRuleName: Allow_URLs, Prefilter Policy: Default Prefilter Policy_1, Client: SSL client, ApplicationProtocol: HTTPS, ConnectionDuration: 98, InitiatorPackets: 14, ResponderPackets: 16, InitiatorBytes: 1802, ResponderBytes: 6133, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: None, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: d08c844c3b312370e87118a194ae6f8d52d3626b, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, SSLServerName: ns1002325.ip-92-204-128.us, URLCategory: Infrastructure and Content Delivery Networks, URLReputation: Neutral, URL: https://ns1002325.ip-92-204-128.us ``` Filebeat.yml configuration file: ```auto fields_under_root: true fields.collector_node_id: AgentServer output.logstash: hosts: ["xx.xx.xx.xx:xxxx"] max_procs: 4 queue: disk: path: C:\Program Files\sequretek\Syslog\data\diskqueue max_size: 10GB segment_size: 1MB retry_interval: 1s filebeat.inputs: - type: syslog enabled: true keep_null: true format: auto timeout: 10 protocol.udp: host: "0.0.0.0:514" - type: syslog enabled: true format: auto timeout: 10 keep_null: true protocol.tcp: host: "0.0.0.0:514" ``` Below is the error getting into log file. ```auto {"log.level":"error","@timestamp":"2024-02-01T19:42:11.413+0530","log.logger":"syslog","log.origin":{"file.name":"syslog/input.go","file.line":285},"message":"can't parse event as syslog rfc3164","service.name":"filebeat","message":"Jan 24 2024 11:22:41 : %FTD-6-430003: EventPriority: Low, DeviceUUID: 70278058-1b77-11ec-a090-feeeb3702f49, InstanceID: 4, FirstPacketSecond: 2024-01-24T11:21:03Z, ConnectionID: 40428, AccessControlRuleAction: Allow, SrcIP: 0.0.0.0, DstIP: 92.204.128.155, SrcPort: 62416, DstPort: 4433, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: inside, EgressZone: outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: Pol_Access_Control, AccessControlRuleName: Allow_URLs, Prefilter Policy: Default Prefilter Policy_1, Client: SSL client, ApplicationProtocol: HTTPS, ConnectionDuration: 98, InitiatorPackets: 14, ResponderPackets: 16, InitiatorBytes: 1802, ResponderBytes: 6133, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: None, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: d08c844c3b312370e87118a194ae6f8d52d3626b, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, SSLServerName: ns1002325.ip-92-204-128.us, URLCategory: Infrastructure and Content Delivery Networks, URLReputation: Neutral, URL: https://ns1002325.ip-92-204-128.us","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2024-02-01T19:42:12.398+0530","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":148},"message":"Failed to connect to backoff(async(tcp://172.24.2.55:7777)): dial tcp 172.24.2.55:7777: connectex: No connection could be made because the target machine actively refused it.","service.name":"filebeat","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2024-02-01T19:42:12.398+0530","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":139},"message":"Attempting to reconnect to backoff(async(tcp://172.24.2.55:7777)) with 1 reconnect attempt(s)","service.name":"filebeat","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2024-02-01T19:42:12.415+0530","log.logger":"syslog","log.origin":{"file.name":"syslog/input.go","file.line":285},"message":"can't parse event as syslog rfc3164","service.name":"filebeat","message":"Jan 24 2024 11:22:41 : %FTD-6-430003: EventPriority: Low, DeviceUUID: 70278058-1b77-11ec-a090-feeeb3702f49, InstanceID: 4, FirstPacketSecond: 2024-01-24T11:21:03Z, ConnectionID: 40428, AccessControlRuleAction: Allow, SrcIP: 0.0.0.0, DstIP: 92.204.128.155, SrcPort: 62416, DstPort: 4433, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: inside, EgressZone: outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: Pol_Access_Control, AccessControlRuleName: Allow_URLs, Prefilter Policy: Default Prefilter Policy_1, Client: SSL client, ApplicationProtocol: HTTPS, ConnectionDuration: 98, InitiatorPackets: 14, ResponderPackets: 16, InitiatorBytes: 1802, ResponderBytes: 6133, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: None, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: d08c844c3b312370e87118a194ae6f8d52d3626b, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, SSLServerName: ns1002325.ip-92-204-128.us, URLCategory: Infrastructure and Content Delivery Networks, URLReputation: Neutral, URL: https://ns1002325.ip-92-204-128.us","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2024-02-01T19:42:13.419+0530","log.logger":"syslog","log.origin":{"file.name":"syslog/input.go","file.line":285},"message":"can't parse event as syslog rfc3164","service.name":"filebeat","message":"Jan 24 2024 11:22:41 : %FTD-6-430003: EventPriority: Low, DeviceUUID: 70278058-1b77-11ec-a090-feeeb3702f49, InstanceID: 4, FirstPacketSecond: 2024-01-24T11:21:03Z, ConnectionID: 40428, AccessControlRuleAction: Allow, SrcIP: 0.0.0.0, DstIP: 92.204.128.155, SrcPort: 62416, DstPort: 4433, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: inside, EgressZone: outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: Pol_Access_Control, AccessControlRuleName: Allow_URLs, Prefilter Policy: Default Prefilter Policy_1, Client: SSL client, ApplicationProtocol: HTTPS, ConnectionDuration: 98, InitiatorPackets: 14, ResponderPackets: 16, InitiatorBytes: 1802, ResponderBytes: 6133, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: None, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: d08c844c3b312370e87118a194ae6f8d52d3626b, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, SSLServerName: ns1002325.ip-92-204-128.us, URLCategory: Infrastructure and Content Delivery Networks, URLReputation: Neutral, URL: https://ns1002325.ip-92-204-128.us","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2024-02-01T19:42:14.421+0530","log.logger":"syslog","log.origin":{"file.name":"syslog/input.go","file.line":285},"message":"can't parse event as syslog rfc3164","service.name":"filebeat","message":"Jan 24 2024 11:22:41 : %FTD-6-430003: EventPriority: Low, DeviceUUID: 70278058-1b77-11ec-a090-feeeb3702f49, InstanceID: 4, FirstPacketSecond: 2024-01-24T11:21:03Z, ConnectionID: 40428, AccessControlRuleAction: Allow, SrcIP: 0.0.0.0, DstIP: 92.204.128.155, SrcPort: 62416, DstPort: 4433, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: inside, EgressZone: outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: Pol_Access_Control, AccessControlRuleName: Allow_URLs, Prefilter Policy: Default Prefilter Policy_1, Client: SSL client, ApplicationProtocol: HTTPS, ConnectionDuration: 98, InitiatorPackets: 14, ResponderPackets: 16, InitiatorBytes: 1802, ResponderBytes: 6133, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: None, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: d08c844c3b312370e87118a194ae6f8d52d3626b, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, SSLServerName: ns1002325.ip-92-204-128.us, URLCategory: Infrastructure and Content Delivery Networks, URLReputation: Neutral, URL: https://ns1002325.ip-92-204-128.us","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2024-02-01T19:42:15.424+0530","log.logger":"syslog","log.origin":{"file.name":"syslog/input.go","file.line":285},"message":"can't parse event as syslog rfc3164","service.name":"filebeat","message":"Jan 24 2024 11:22:41 : %FTD-6-430003: EventPriority: Low, DeviceUUID: 70278058-1b77-11ec-a090-feeeb3702f49, InstanceID: 4, FirstPacketSecond: 2024-01-24T11:21:03Z, ConnectionID: 40428, AccessControlRuleAction: Allow, SrcIP: 0.0.0.0, DstIP: 92.204.128.155, SrcPort: 62416, DstPort: 4433, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: inside, EgressZone: outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: Pol_Access_Control, AccessControlRuleName: Allow_URLs, Prefilter Policy: Default Prefilter Policy_1, Client: SSL client, ApplicationProtocol: HTTPS, ConnectionDuration: 98, InitiatorPackets: 14, ResponderPackets: 16, InitiatorBytes: 1802, ResponderBytes: 6133, NAPPolicy: Balanced Security and Connectivity, SSLPolicy: None, SSLFlowStatus: Success, SSLCipherSuite: Unknown, SSLCertificate: d08c844c3b312370e87118a194ae6f8d52d3626b, SSLVersion: Unknown, SSLServerCertStatus: Valid, SSLActualAction: Do Not Decrypt, SSLExpectedAction: Do Not Decrypt, SSLServerName: ns1002325.ip-92-204-128.us, URLCategory: Infrastructure and Content Delivery Networks, URLReputation: Neutral, URL: https://ns1002325.ip-92-204-128.us","ecs.version":"1.6.0"} ``` I performed this test since I saw this issue in the production environment. Looking for a solution. Thanks, Amol ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [February 1, 2024, 9:40pm UTC](https://discuss.elastic.co/t/cant-parse-event-as-syslog-rfc3164/352307/2 "2024-02-01T21:40:34Z")
> [@Amol\_Sahare](#): > > `Jan 24 2024 11:22:41 : ` RFC3164 timestamps are not allowed to include a year > **[RFC 3164: The BSD Syslog Protocol](https://datatracker.ietf.org/doc/html/rfc3164#section-4.3.1)** > > This document describes the observed behavior of the syslog protocol. This memo provides information for the Internet community. > It has been found that some network administrators like to archive > their syslog messages over long periods of time. It has been seen > that some original syslog messages contain a more explicit time stamp > in which a 2 character or 4 character year field immediately follows > the space terminating the TIMESTAMP. This is not consistent with the > original intent of the order and format of the fields. If > implementers wish to contain a more specific date and time stamp > within the transmitted message, it should be within the CONTENT > field. Implementers may wish to utilize the ISO 8601 [7] date and > time formats if they want to include more explicit date and time > information. Is FTD here Firepower Threat Defense? you should be able to specify the timestamp format as RFC5424: > Beginning with version 6.3, Secure Firewall Threat Defense provides the option to enable timestamp as per RFC 5424 in eventing syslogs. See: [Cisco Secure Firewall Threat Defense Syslog Messages - About This Guide [Cisco Secure Firewall Management Center] - Cisco](https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide/about.html) Other options include: 1. You could also look at using Elastic Agent with the Cisco Integration which would handle the message parsing for you once you set the timestamp format. 2. If you dont want to change the timezone format you could switch from a Syslog input to a UDP and TCP input and perform the parsing with a beat processor as well. ---
**Author:** ![Amol\_Sahare](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amol_sahare/32/122260_2.png) [@Amol\_Sahare](https://discuss.elastic.co/u/Amol_Sahare)\ **Post date:** [February 5, 2024, 5:43am UTC](https://discuss.elastic.co/t/cant-parse-event-as-syslog-rfc3164/352307/3 "2024-02-05T05:43:03Z")
Hi Strawgate, Thanks for your reply. I have two question in this. 1. If format is not supported then how come few message are getting parsed? 2. If format is not getting parse then what is the process for add format into filebeat? Regards, Amol ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [February 5, 2024, 1:21pm UTC](https://discuss.elastic.co/t/cant-parse-event-as-syslog-rfc3164/352307/4 "2024-02-05T13:21:07Z")
> [@Amol\_Sahare](#): > > If format is not getting parse then what is the process for add format into filebeat If you dont want to change the timezone format on the device itself (its configurable) you could switch from a Syslog input to a UDP and TCP input and perform the syslog parsing with a beat processor. I'd have to see the messages that are parsing correctly to figure out why they might be parsing correctly. ---
**Author:** ![Amol\_Sahare](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amol_sahare/32/122260_2.png) [@Amol\_Sahare](https://discuss.elastic.co/u/Amol_Sahare)\ **Post date:** [February 5, 2024, 2:50pm UTC](https://discuss.elastic.co/t/cant-parse-event-as-syslog-rfc3164/352307/5 "2024-02-05T14:50:35Z")
Thanks. It is working. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 4, 2024, 4:50pm UTC](https://discuss.elastic.co/t/cant-parse-event-as-syslog-rfc3164/352307/6 "2024-03-04T16:50:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.