# Centos 7 / rsyslog / logstash 6.3.0 - on logstash output always severity code 5 and facility code 1 (2)

**URL:** <https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265>\
**Category:** Logstash\
**Created:** [July 17, 2018, 7:28am UTC](https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265 "2018-07-17T07:28:22Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![pge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pge/32/32641_2.png) [@pge](https://discuss.elastic.co/u/pge)\
**Post date:** [July 18, 2018, 12:53pm UTC](https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265/4 "2018-07-18T12:53:14Z")

</div>

Hi @yaauie

for what i can test (at the moment the ELK cluster is still not on production) "..anchoring the pattern to the beginning of the string..." works good and improve the performances. 😃

Regarding the pipeline I´m still testing different rsyslog formats but using the basic approach ( [sample configuration](https://discuss.elastic.co/t/centos-7-5-with-rsyslog-8-24-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-other-post-found-on-but-still-not-solved/137206) ) I´m still receiving messages with wrong severity/facility.

I´ve tested all the standard rsyslog templates on rsyslog forwarding rule with the result to win a "\_grokparsefailure" when I use a different log format 😕

```
# RSYSLOG_TraditionalFileFormat - the "old style" default log file format with low-precision timestamps
# RSYSLOG_FileFormat - a modern-style logfile format similar to TraditionalFileFormat, 
# buth with high-precision timestamps and timezone information
# RSYSLOG_TraditionalForwardFormat - the traditional forwarding format with low-precision timestamps. 
# Most useful if you send messages to other syslogd's or rsyslogd below version 3.12.5.
# RSYSLOG_ForwardFormat - a new high-precision forwarding format very similar to the traditional one, but with 
# high-precision timestamps and timezone information. Recommended to be used when sending 
# messages to rsyslog 3.12.5 or above.
# RSYSLOG_SyslogProtocol23Format - the format specified in IETF's internet-draft ietf-syslog-protocol-23, which is assumed 
# to be come the new syslog standard RFC. This format includes several improvements. 
# The rsyslog message parser understands this format, so you can use it together with all 
# relatively recent versions of rsyslog. Other syslogd's may get hopelessly confused if 
# receiving that format, so check before you use it. Note that the format is unlikely to 
# change when the final RFC comes out, but this may happen.

```

... to be continued ....

---

_[View the full topic](https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265)._