# Dell iDrac Syslog Grok Logstash

**URL:** <https://discuss.elastic.co/t/dell-idrac-syslog-grok-logstash/320198>\
**Category:** Logstash\
**Created:** [November 30, 2022, 9:52pm UTC](https://discuss.elastic.co/t/dell-idrac-syslog-grok-logstash/320198 "2022-11-30T21:52:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rcraigncs](https://avatars.discourse-cdn.com/v4/letter/r/3e96dc/32.png) [@rcraigncs](https://discuss.elastic.co/u/rcraigncs)\
**Post date:** [November 30, 2022, 9:52pm UTC](https://discuss.elastic.co/t/dell-idrac-syslog-grok-logstash/320198/1 "2022-11-30T21:52:58Z")

</div>

I am looking for help to grok Syslog from Dell idrac I am having problems taking the grok below and making it work with a Logstash. Your help is deeply appreciated!

Extracting additional fields from iDRAC logs I found online.

```auto
<Exec>
        parse_syslog();
        if $Message =~ /(?x)^([a-zA-Z]*),\ Category:\ ([a-zA-Z]*),
                        \ MessageID:\ ([a-zA-Z0-9]*),\ Message:\ (.*)$/
        {
            $DracMsgLevel = $1;
            $DracMscCategory = $2;
            $DracMscID = $3;
            $DracMessage = $4;
        }
    </Exec>

```

My logstash conf

```auto
input {
  udp { 
    port => "514"
    type => "syslog"
  }
}

filter {
if [type] == "syslog" {
}
if [host] == '101' {
	mutate {
		add_tag => ["idrac"]
	}
    grok { # Match syslog data and add fields
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date { # Match date in syslog message and set timestamp field to this
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
      target => "syslog_timestamp"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![rcraigncs](https://avatars.discourse-cdn.com/v4/letter/r/3e96dc/32.png) [@rcraigncs](https://discuss.elastic.co/u/rcraigncs)\
**Post date:** [November 30, 2022, 11:10pm UTC](https://discuss.elastic.co/t/dell-idrac-syslog-grok-logstash/320198/2 "2022-11-30T23:10:56Z")

</div>

here is what the message log looks like what's my option to grok this?

```auto
{
  "_index": "syslog-2022.11.30",
  "_id": "2ELOyoQBFRFz4SudHDNI",
  "_version": 1,
  "_score": null,
  "_source": {
    "tags": [
      "idrac",
      "_grokparsefailure"
    ],
    "type": "syslog",
    "@version": "1",
    "message": "<182>os[16910]: 2022 RAC:login failed from fsdfd: '10.1.1.1 \n",
    "@timestamp": "2022-11-30T23:10:16.030Z",
    "host": "10.1.1.1"
  },
  "fields": {
    "@timestamp": [
      "2022-11-30T23:10:16.030Z"
    ]
  },
  "sort": [
    1669849816030
  ]
}

```

---

<div class="post-metadata">

**Author:** ![rcraigncs](https://avatars.discourse-cdn.com/v4/letter/r/3e96dc/32.png) [@rcraigncs](https://discuss.elastic.co/u/rcraigncs)\
**Post date:** [December 1, 2022, 5:32pm UTC](https://discuss.elastic.co/t/dell-idrac-syslog-grok-logstash/320198/3 "2022-12-01T17:32:24Z")

</div>

Here is my updated grok what should I do to improve it?

```auto
filter {
if [type] == "syslog" {
}
if [host] == '10.22.0.71' {
	mutate {
		add_tag => ["idrac"]
	}
  syslog_pri { }
    }
    grok { # Match syslog data and add fields
      match => { "message" => " %{GREEDYDATA:DracMessage}" }
    }
    date { # Match date in syslog message and set timestamp field to this
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
      target => "syslog_timestamp"
    }
  }

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/8/28c93c0c28180b52bf78b881e8a45c76dd43b994.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 29, 2022, 5:32pm UTC](https://discuss.elastic.co/t/dell-idrac-syslog-grok-logstash/320198/4 "2022-12-29T17:32:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.