# Grok pattern for this syslog message for Logstash? **URL:** \ **Category:** Logstash\ **Created:** [October 5, 2021, 9:05am UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896 "2021-10-05T09:05:48Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [October 5, 2021, 9:05am UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/1 "2021-10-05T09:05:48Z")
Hello I have this syslog message which is ALMOST like the standard RFC3164 so the default syslog plugin should pick it up: `<134>1 2021-10-05T08:48:18Z MYSERVER iLO5 - - - XML logout: SomeUser - 1.2.3.4(DNS name not found).` I was reading the RFC and (this is offtopic), I honestly do not understand how to break down the 134; I know it is a bit representation of it being a emergency, critical, etc. but I dont seem to understand it. The rest seems pretty straight forward. Is that "1" after \<134\> messing everything up? Thank you for the help ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [October 5, 2021, 10:53am UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/2 "2021-10-05T10:53:58Z")
You can use the [syslog pri filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-syslog_pri.html) to parse after you grok it if you needed to. Also I do not know what that 1 is, never seen anything like that. You would need to go back to what is generating the log to figure that out. **Test Conf** ```auto input { generator { lines => ['{ "message": 134 }'] count => 1 codec => "json" } } filter{ syslog_pri { } } output { stdout { codec => json } } ``` **Output** ```auto { "@timestamp": "2021-10-05T10:52:35.412Z", "syslog_severity_code": 5, "syslog_facility_code": 1, "syslog_severity": "notice", "message": 134, "syslog_facility": "user-level" } ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 5, 2021, 1:15pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/3 "2021-10-05T13:15:02Z")
The `1` after the syslog pri is the syslog protocol version. The RFC 3164 is obsolete, you should look at the RFC 5424. The `version` is described in this part of the [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.2) and the syslog pri calculation is explained in this [part of the RFC](https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1). As Aaron said, the `syslog_pri` filter you get you the `syslog_facility` and `syslog_severity` from the `syslog_pri` number. ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [October 5, 2021, 1:52pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/4 "2021-10-05T13:52:44Z")
There is something Im missing. Ill post my current Logstash config ```auto input { syslog { timezone => "Europe/Madrid" port => "5062" type => "syslog" } } filter { grok { match => { "message" => "%{SYSLOG5424PRI} %{DATE_US:DateILO} %{TIME:TimeiLO} %{GREEDYDATA:LogMessage}" } } mutate { add_field => { "iLOTimestamp" => "%{DateILO} %{TimeiLO}"} } date { match => ["iLOTimestamp", "MM/dd/yyyy HH:mm:ss"] timezone => "UTC" target => "iLOTimestamp" } } output { elasticsearch { hosts => ["localhost"] user => ["elastic"] password => ["CENSORED"] ilm_enabled => true ilm_policy => "logs-ilp" index => "syslog-hpeilologs-%{+yyyy.MM}" } stdout { codec => rubydebug } } ``` Im using the date plugin because for some odd reason, my iLO doesnt show local time, instead it shows UTC time and Ive been trying to translate it but nothing so far (Thats another topic) Now, it looks very difficult to what you are proposing and starting with the input. Could you please explain? Thank you. ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [October 5, 2021, 2:22pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/5 "2021-10-05T14:22:22Z")
I found a even better one: ```auto filter { grok { match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:version} %{TIMESTAMP_ISO8601:DateILO} %{DATA:HostName} %{GREEDYDATA:LogMessage}" } } } ``` The only thing that is not working is SYSLOG5424PRI; It doesnt split that initial value into Emergency, etc.... ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [October 5, 2021, 2:23pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/6 "2021-10-05T14:23:23Z")
> [@aaron-nimocks](#): > > ```auto > filter{ > syslog_pri { } > } > > ``` You have to add the above to do that parsing. ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [October 5, 2021, 2:27pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/7 "2021-10-05T14:27:20Z")
Where exactly? Just add it? ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [October 5, 2021, 2:29pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/8 "2021-10-05T14:29:06Z")
> [@aaron-nimocks](#): > > ```auto > filter{ > syslog_pri { } > } > > ``` Yup....lol...It just works..... I still do not understand Logstash at all on how it works. ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [October 5, 2021, 2:35pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/9 "2021-10-05T14:35:18Z")
Looking way better ```auto @timestamp Oct 5, 2021 @ 16:28:18.011 @version 1 DateILO Oct 5, 2021 @ 16:28:17.000 HostName HOSTNAME LogMessage iLO5 - - - XML logout: user - 1.2.3.4(DNS name not found). _id c83aUHwBCddptw5j8GpB _index syslog-hpeilologs-2021.10 _score - _type _doc facility 0 facility_label kernel host 1.2.3.4 message <134>1 2021-10-05T14:28:17Z HOSTNAME iLO5 - - - XML logout: user - 1.2.3.4(DNS name not found). priority 0 severity 0 severity_label Emergency syslog5424_pri 134 syslog_facility user-level syslog_facility_code 1 syslog_severity notice syslog_severity_code 5 syslogversion 1 tags _grokparsefailure_sysloginput type syslog ``` That being said, I see a facility\_label and a severity\_label that are different from syslog\_facility and syslog\_severity ; Why? How can I remove them? Or fix them? Also I see "tags \_grokparsefailure\_sysloginput" which is usually because something has failed. Any way to fix? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 2, 2021, 2:35pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896/10 "2021-11-02T14:35:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.