# Grok patterns for syslog configuration in logstash

**URL:** <https://discuss.elastic.co/t/grok-patterns-for-syslog-configuration-in-logstash/86938>\
**Category:** Logstash\
**Created:** [May 24, 2017, 9:52am UTC](https://discuss.elastic.co/t/grok-patterns-for-syslog-configuration-in-logstash/86938 "2017-05-24T09:52:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elbesraoui\_imane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elbesraoui_imane/32/17700_2.png) [@elbesraoui\_imane](https://discuss.elastic.co/u/elbesraoui_imane)\
**Post date:** [May 24, 2017, 9:52am UTC](https://discuss.elastic.co/t/grok-patterns-for-syslog-configuration-in-logstash/86938/1 "2017-05-24T09:52:54Z")

</div>

Hi,I recentely started working with the ELK stack but I have a problem for  
my syslog logstash configuration. Can you give me hand pleaase ? I don't know what's the problem I'm having in my config file, but when i do the /bin/logstash -f it gives me this :  
Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}

---

<div class="post-metadata">

**Author:** ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)\
**Post date:** [May 24, 2017, 11:21am UTC](https://discuss.elastic.co/t/grok-patterns-for-syslog-configuration-in-logstash/86938/2 "2017-05-24T11:21:58Z")

</div>

Hi,  
could you please post your config ?  
What u post here

```
 Attempting to install template 
{:manage_template=>
      {"template"=>"logstash-",
        "version"=>50001,
        "settings"=>
              {"index.refresh_interval"=>"5s"},
                "mappings"=>
                          {"default"=>
                                   {"all"=>
                                          {"enabled"=>true, 
                                            "norms"=>false},
                                     "dynamictemplates"=>
                                           [{"message_field"=>
                                   ....

```

Is just an info message that tell you the default template is installed. I don't this is something wrong with that.

Did you get any document into the elasticsearch node ?

cheers

pts0

---

<div class="post-metadata">

**Author:** ![elbesraoui\_imane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elbesraoui_imane/32/17700_2.png) [@elbesraoui\_imane](https://discuss.elastic.co/u/elbesraoui_imane)\
**Post date:** [May 24, 2017, 11:59am UTC](https://discuss.elastic.co/t/grok-patterns-for-syslog-configuration-in-logstash/86938/4 "2017-05-24T11:59:04Z")

</div>

Hi Kim,  
this is my config :

```
 input {
    file {
    path => "/data/log/testlogstash/messages"
    type => "syslog"
    start_position => "beginning"
    }

    }

    filter {
    if [type] == "syslog" {
    grok {
    patterns_dir => "/etc/logstash/conf.d/patterns/"
    match => ["message", "(%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:syslog_process}\[%{NUMBER:syslog_uid}\]:(?=%{GREEDYDATA:syslog_message})|(%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program} \|%{NUMBER:syslog_epoch:int}\|%{IP:syslog_ip}\|%{GREEDYDATA:syslog_path}\|%{GREEDYDATA:syslog_title}\|%{GREEDYDATA:syslog_referrer}\|%{NUMBER:syslog_uid}\|%{GREEDYDATA:syslog_sid}\|%{NUMBER:syslog_timer:int}\|%{GREEDYDATA:syslog_cache}\|%{GREEDYDATA:syslog_user_agent}\|%{NUMBER:syslog_peak_memory:int}))"]

    }
    if "_grokparsefailure" in [tags] {
                            drop { }
                    }
      

     }

    }

    output {
     elasticsearch { hosts => ["localhost:9200"]
     index => "syslogindex-%{+YYYY.MM.dd}"
    sniffing => false
     manage_template => false
    }
     stdout { codec => rubydebug }
    }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 28, 2017, 6:56pm UTC](https://discuss.elastic.co/t/grok-patterns-for-syslog-configuration-in-logstash/86938/5 "2017-05-28T18:56:30Z")

</div>

There is nothing wrong with your configuration. The message is an informational message that you'll get every time Logstash starts up if you have an elasticsearch output. Move on.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2017, 6:56pm UTC](https://discuss.elastic.co/t/grok-patterns-for-syslog-configuration-in-logstash/86938/6 "2017-06-25T18:56:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.