# Form the syslog\_pri field

**URL:** <https://discuss.elastic.co/t/form-the-syslog-pri-field/300814>\
**Category:** Logstash\
**Created:** [March 28, 2022, 8:44am UTC](https://discuss.elastic.co/t/form-the-syslog-pri-field/300814 "2022-03-28T08:44:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [March 28, 2022, 8:44am UTC](https://discuss.elastic.co/t/form-the-syslog-pri-field/300814/1 "2022-03-28T08:44:29Z")

</div>

I have the following syslog messages -

```auto
Oct 18 16:11:54 1aen ai_controller[419]: [16:11:54.479933] ERROR [ntp_client.cpp:113 fetch_time()] Can't get NTP response
Oct 18 16:11:55 1aen ntpd[442]: bind(21) AF_INET6 fe80::868b:cdff:fe20:32a%2#123 flags 0x11 failed: Cannot assign requested address
Oct 18 16:11:55 1aen ntpd[442]: unable to create socket on eth0 (5) for fe80::868b:cdff:fe20:32a%2#123

```

The grok pattern constructed for this is  
`%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}`

However, I need the syslog\_pri field to be able to obtain the severity. How can i do the same? Help would be appreciated

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 28, 2022, 2:41pm UTC](https://discuss.elastic.co/t/form-the-syslog-pri-field/300814/2 "2022-03-28T14:41:54Z")

</div>

> [@anushka1203](#):
>
> However, I need the syslog\_pri field to be able to obtain the severity. How can i do the same?

You cannot do so. The messages do not contain the priority.

---

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [March 29, 2022, 3:25am UTC](https://discuss.elastic.co/t/form-the-syslog-pri-field/300814/3 "2022-03-29T03:25:56Z")

</div>

Thank you so much for confirming.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2022, 3:26am UTC](https://discuss.elastic.co/t/form-the-syslog-pri-field/300814/4 "2022-04-26T03:26:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.