# Cisco not sending clean syslog message

**URL:** <https://discuss.elastic.co/t/cisco-not-sending-clean-syslog-message/376195>\
**Category:** Logstash\
**Created:** [March 20, 2025, 5:14pm UTC](https://discuss.elastic.co/t/cisco-not-sending-clean-syslog-message/376195 "2025-03-20T17:14:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![justin3](https://avatars.discourse-cdn.com/v4/letter/j/278dde/32.png) [@justin3](https://discuss.elastic.co/u/justin3)\
**Post date:** [March 20, 2025, 5:14pm UTC](https://discuss.elastic.co/t/cisco-not-sending-clean-syslog-message/376195/1 "2025-03-20T17:14:24Z")

</div>

I have a cisco WLC that is sending syslog to my logstash server but isn't sending clean syslog messages. It is adding extra stuff before the hostname, special characters before other parts of the message. I've found one other reference to this message issue but their fix was unclear. Example message:  
\<131\>S0WLC: \*Dot1x\_NW\_MsgTask\_3: Mar 20 11:53:53.086: %DOT1X-3-INVALID\_REPLAY\_CTR: [SA]Invalid replay counter from client xx:xx:xx:xx:xx:xx - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 20, 2025, 6:27pm UTC](https://discuss.elastic.co/t/cisco-not-sending-clean-syslog-message/376195/2 "2025-03-20T18:27:54Z")

</div>

If you are using a syslog input then you can set the [grok\_pattern](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html#plugins-inputs-syslog-grok_pattern) option to tell it how to parse that.