# Filtering syslog message

**URL:** <https://discuss.elastic.co/t/filtering-syslog-message/279877>\
**Category:** Logstash\
**Created:** [July 28, 2021, 2:47pm UTC](https://discuss.elastic.co/t/filtering-syslog-message/279877 "2021-07-28T14:47:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dovan](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Dovan](https://discuss.elastic.co/u/Dovan)\
**Post date:** [July 28, 2021, 2:47pm UTC](https://discuss.elastic.co/t/filtering-syslog-message/279877/1 "2021-07-28T14:47:35Z")

</div>

hello, I'm new to ELK and I'm trying to use logstash to consume logs from a syslog server I have, how do I extract the messages that arrive inside the message field?  
here is a log sample:

```auto
"<133>Jul 28 09:59:11 10.128.xx.xxx CEF:0|Trend Micro|Apex Central|2019|8001xx|Pattern Update Status|3|rt=Jul 28 2021 12:57:52 GMT+00:00|shost=NREXXXXXXXX|cs1Label=Operating_System|cs1=Windows 10 |cs2Label=Product/Endpoint_IP|cs2=xxx.11.0.xx|cs3Label=Update_Agent|cs3=0|cs4Label=Domain|cs4=Agentes desatualizados|cn1Label=Connection_Status|cn1=100|cn2Label=Pattern/Rule|cn2=12xxxxxxx|cs5LabelPattern/Rule_Version|cs516.xxx.xx|cn3Label=Pattern/Rule_Status|cn3=1|cs6LabelAUComponent_Type|cs62|deviceFacility=Apex One msg=Smart Scan Agent Pattern deviceNtDomain=REDExxxx dntdom=Agentes desatualizados\\\\ "

```

Any help will be welcome!

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 28, 2021, 3:24pm UTC](https://discuss.elastic.co/t/filtering-syslog-message/279877/2 "2021-07-28T15:24:21Z")

</div>

You mean parse the message and create fields?

What is your input? Your message is in the `CEF` format, you could use the `cef` codec to parse it.

For example, if your input is `udp` you would have something like this:

```auto
input {
    udp {
        port => port-number
        codec => cef
    }
}

```

---

<div class="post-metadata">

**Author:** ![Dovan](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Dovan](https://discuss.elastic.co/u/Dovan)\
**Post date:** [July 28, 2021, 5:46pm UTC](https://discuss.elastic.co/t/filtering-syslog-message/279877/3 "2021-07-28T17:46:15Z")

</div>

hi @leandrojmp ! thanks for the help, and yes, i mean parse the message and create fields.  
here's the input:

```auto
input {
  tcp {
    port => 6803
    type => syslog
  }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 28, 2021, 8:15pm UTC](https://discuss.elastic.co/t/filtering-syslog-message/279877/4 "2021-07-28T20:15:39Z")

</div>

Just try to use the `cef` codec as the example.

```auto
input {
  tcp {
    port => 6803
    codec => cef
    type => syslog
  }
}

```

---

<div class="post-metadata">

**Author:** ![Dovan](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Dovan](https://discuss.elastic.co/u/Dovan)\
**Post date:** [July 28, 2021, 8:18pm UTC](https://discuss.elastic.co/t/filtering-syslog-message/279877/5 "2021-07-28T20:18:19Z")

</div>

Valeu @leandrojmp ! funcionou, obrigado pela ajuda

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2021, 8:19pm UTC](https://discuss.elastic.co/t/filtering-syslog-message/279877/6 "2021-08-25T20:19:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.