# Creating a Logstash filter help

**URL:** <https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794>\
**Category:** Logstash\
**Created:** [October 22, 2015, 5:35pm UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794 "2015-10-22T17:35:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\
**Post date:** [October 22, 2015, 5:35pm UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794/1 "2015-10-22T17:35:23Z")

</div>

Hi,

I am in a process of checking if kibana can be used to help me with my log analysis. I am new to the logstash and elasticsearch technology and will be happy to get help to jump start my tests.

I am using syslog to forward my events to the Kibana server.

for the following log format, can someone help me with:

1. How do I logstash to receive the syslog events which are not coming from a logstash forwarder?

2. what is the logstash filter you recommend to use

3. How do I set the filter in logstash

Thanks for the help  
Yoram

---

<div class="post-metadata">

**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\
**Post date:** [October 22, 2015, 10:43pm UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794/2 "2015-10-22T22:43:46Z")

</div>

I would use either tcp or udp input and then a grok, something like:

```
input {
  tcp {
    port => 5514
    type => syslog
  }
}
filter {
  if [type] == "syslog" {
    grok {
      match => {
        message => '%{POSINT:syslog_pri} %{TIMESTAMP_ISO8601:syslog_timestamp} (%{IPORHOST:host} )?%{DATA:process}(?:[\[]?%{POSINT:pid}[\] ]?:?)? %{GREEDYDATA:syslog_message}'
      }
    }
    date {
      match => ['syslog_timestamp', 'ISO8601']
      remove_field => ['syslog_timestamp']
    }
    if [syslog_pri] {
      syslog_pri { }
    }
  }
}

```

Some details to fill in yourself since there is no standard format for syslog messages. Hope it helps.

---

<div class="post-metadata">

**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\
**Post date:** [October 22, 2015, 11:18pm UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794/3 "2015-10-22T23:18:17Z")

</div>

Hi,

Thanks for the answer. I am flying back from a business travel so I will check it on Sunday and let you know if it worked for me.

two questions about the filter.  
1.I saw you selected the port 5514 which is not a standard syslog port. Any reason to do so?  
2. If I use UDP I am guessing that I need to change the TCP in the filter to UDP? right

Thanks  
Yoram

---

<div class="post-metadata">

**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\
**Post date:** [October 22, 2015, 11:23pm UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794/4 "2015-10-22T23:23:52Z")

</div>

Ok. Don't forget to update that grok line to match your format. [https://grokdebug.herokuapp.com](https://grokdebug.herokuapp.com) is your friend.

1. The port is arbitrary - use what you prefer.
2. Correct.

Good luck.

---

<div class="post-metadata">

**Author:** ![yoram](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@yoram](https://discuss.elastic.co/u/yoram)\
**Post date:** [October 22, 2015, 11:54pm UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794/5 "2015-10-22T23:54:26Z")

</div>

Thanks.

Grok is another thing to learn... Well I have the weekend

Thanks again

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 23, 2015, 8:03am UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794/6 "2015-10-23T08:03:56Z")

</div>

> I saw you selected the port 5514 which is not a standard syslog port. Any reason to do so?

Unless you run Logstash as root (which isn't recommended) or employ one of the possible workarounds Logstash won't be able to listen on any port \<1024.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794/7 "2017-07-06T05:25:40Z")

</div>