Form the syslog_pri field

Elastic Stack Logstash
1

I have the following syslog messages -

Oct 18 16:11:54 1aen ai_controller[419]: [16:11:54.479933] ERROR     [ntp_client.cpp:113 fetch_time()] Can't get NTP response
Oct 18 16:11:55 1aen ntpd[442]: bind(21) AF_INET6 fe80::868b:cdff:fe20:32a%2#123 flags 0x11 failed: Cannot assign requested address
Oct 18 16:11:55 1aen ntpd[442]: unable to create socket on eth0 (5) for fe80::868b:cdff:fe20:32a%2#123

The grok pattern constructed for this is
%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}

However, I need the syslog_pri field to be able to obtain the severity. How can i do the same? Help would be appreciated

Thank you

2

You cannot do so. The messages do not contain the priority.

3

Thank you so much for confirming.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.