# Filebeat Syslog RFC 5424 Input With Empty Timestamp
**URL:** https://discuss.elastic.co/t/filebeat-syslog-rfc-5424-input-with-empty-timestamp/293595
**Category:** Beats
**Tags:** filebeat
**Created:** [January 5, 2022, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-syslog-rfc-5424-input-with-empty-timestamp/293595 "2022-01-05T21:06:33Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@jtveite](https://discuss.elastic.co/u/jtveite)
#### Post date: [January 5, 2022, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-syslog-rfc-5424-input-with-empty-timestamp/293595/1 "2022-01-05T21:06:33Z")
RFC 5424 explicitly allows timestamp to be a nilvalue. I have a device which generates logs of this format that I am attempting to collect, but filebeat appears to only accept messages that have a timestamp specified.
Having taken a quick look at the code I believe this is happening because `parseAndCreateEvent5424` in `filebeat/input/syslog/input.go` checks for `ev.IsValid` which checks the day/hour/minute/second fields having been initialized.
Here is a short python program that demonstrates the problem if pointed at a filebeat instance (change the SYSLOG\_IP variable). I have tested this against 7.16.2 as well as 8.0.0-beta1 as well as both auto and rfc5424 syslog formats.
```auto
SYSLOG_IP='192.168.4.14'
SYSLOG_PORT=514
original_msg = "<142>1 - 1.2.3.4 Host - - - FAILING COPIED MESSAGE"
changed_msg = "<142>1 2022-01-01T01:23:45.003Z 1.2.3.4 Host - - - GOOD CHANGED MESSAGE"
def send(msg):
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(msg.encode('utf-8'), (SYSLOG_IP, SYSLOG_PORT))
send(original_msg)
send(changed_msg)
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2022, 11:07pm UTC](https://discuss.elastic.co/t/filebeat-syslog-rfc-5424-input-with-empty-timestamp/293595/2 "2022-02-02T23:07:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.