I have a cisco WLC that is sending syslog to my logstash server but isn't sending clean syslog messages. It is adding extra stuff before the hostname, special characters before other parts of the message. I've found one other reference to this message issue but their fix was unclear. Example message:
<131>S0WLC: *Dot1x_NW_MsgTask_3: Mar 20 11:53:53.086: %DOT1X-3-INVALID_REPLAY_CTR: [SA]Invalid replay counter from client xx:xx:xx:xx:xx:xx - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02
If you are using a syslog input then you can set the grok_pattern option to tell it how to parse that.