# Cisco UCS message match

**URL:** <https://discuss.elastic.co/t/cisco-ucs-message-match/84760>\
**Category:** Logstash\
**Created:** [May 5, 2017, 4:45pm UTC](https://discuss.elastic.co/t/cisco-ucs-message-match/84760 "2017-05-05T16:45:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [May 5, 2017, 4:45pm UTC](https://discuss.elastic.co/t/cisco-ucs-message-match/84760/1 "2017-05-05T16:45:46Z")

</div>

Hello, we're receiving messages from the Cisco UCS system in the following format:

`<181>: 2017 May 5 17:34:40 BST: last message repeated 1 time`

The Grok debugger at [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) confirms the following patter does match:

`%{SYSLOG5424PRI}:%{SPACE}%{YEAR}%{SPACE}%{CISCOTIMESTAMP}%{SPACE}%{DATA:timezone}:%{SPACE}%{GREEDYDATA:syslog_message}`

I have the following in Logstash.conf:

> if [type] == "syslogucs" {  
> grok {  
> match =\> { "message" =\> "%{SYSLOG5424PRI}:%{SPACE}%{YEAR}%{SPACE}%{CISCOTIMESTAMP}%{SPACE}%{DATA:timezone}:%{SPACE}%{GREEDYDATA:syslog\_message}" }  
> add\_field =\> ["received\_at", "%{@timestamp}"]  
> add\_field =\> ["received\_from", "%{host}"]  
> }  
> syslog\_pri { }  
> }

However when I view the message in Kibana it doesn't look right, for example the syslog priority isn't identified for a start:

```
@timestamp May 5th 2017, 17:34:39.891
t @version 1
t _id AVvZdnpWlq-Z6-tmfLE2
t _index syslogucs-2017.05
# _score - 
t _type syslogucs
t host 192.168.27.6
t message <181>: 2017 May 5 17:34:40 BST: last message repeated 1 time
t type syslogucs

```

Can anyone help?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2017, 4:46pm UTC](https://discuss.elastic.co/t/cisco-ucs-message-match/84760/2 "2017-06-02T16:46:42Z")

</div>

Closed on June 2, 2017, 4:46pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.