# Grokking the Linux authorization logs **URL:** \ **Category:** Logstash\ **Created:** [October 19, 2017, 1:38am UTC](https://discuss.elastic.co/t/grokking-the-linux-authorization-logs/104467 "2017-10-19T01:38:09Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [October 19, 2017, 1:38am UTC](https://discuss.elastic.co/t/grokking-the-linux-authorization-logs/104467/1 "2017-10-19T01:38:10Z")
Attempting to use a syslog pattern to parse ubuntu logs for building auth reports but having issues with syslog-filter.conf file. Below are the config files and error message: Error message: > [2017-10-18T20:34:18,093][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"} > [2017-10-18T20:34:18,095][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"} > [2017-10-18T20:34:18,278][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, =\> at line 20, column 356 (byte 690) after filter {\n if [document\_type] == "syslog" {\n grok {\n match =\> {"%{SYSLOGTIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:system.auth.hostname} sshd(?:\\[%{POSINT:system.auth.pid}\\])?: %{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user )?%{DATA:system.auth.user} from %{IPORHOST:system.auth.ip} port %{NUMBER:system.auth.port} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?""} Syslog-filter.conf(installed on logstash at /etc/logstash/conf.d/syslog-filter.conf): > filter { > if [document\_type] == "syslog" { > grok { > match =\> {"%{SYSLOGTIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:system.auth.hostname} sshd(?:\[%{POSINT:system.auth.pid}\])?: %{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user )?%{DATA:system.auth.user} from %{IPORHOST:system.auth.ip} port %{NUMBER:system.auth.port} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?"} > } > } > } Filebeat.yml(from ubuntu host): > #=========================== Filebeat prospectors ============================= > > filebeat.prospectors: > > - input\_type: log > > #----------------------------- Logstash output -------------------------------- > output.logstash: > #The Logstash hosts > hosts: ["removed.ip.:5044"] > #loadbalance: true > bulk\_max\_size: 2048 > #ssl.certificate\_authorities: ["/etc/filebeat/logstash.crt"] > template.name: "filebeat" > template.path: "filebeat.template.json" > template.overwrite: false > index: removed I've tried hunting down the line and column but I don't know what should be changed. Thanks in advance for any help. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 19, 2017, 5:47am UTC](https://discuss.elastic.co/t/grokking-the-linux-authorization-logs/104467/2 "2017-10-19T05:47:57Z")
Your grok filter isn't including the name of the field you want to parse. Compare your grok filter to the examples in the documentation and you'll spot your mistake. ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [October 20, 2017, 1:06am UTC](https://discuss.elastic.co/t/grokking-the-linux-authorization-logs/104467/3 "2017-10-20T01:06:26Z")
Hi Magnus, Thank you for your help, I located my issue, needed to added "message" after match in the syslog filter. But now I am getting a different error message: ``` [2017-10-19T20:56:59,938][INFO][org.logstash.beats.Server] Starting server on port: 5044 [2017-10-19T20:57:01,980][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin. Plugin: 5044, id=>"506b195a3ca1046d389dbb163621f089413fb78c-4", enable_metric=>true, codec=>"plain_c28505b6-d915-4c17-a189-65d8ee6e271d", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl=>false, ssl_verify_mode=>"none", include_codec_tag=>true, ssl_handshake_timeout=>10000, congestion_threshold=>5, target_field_for_codec=>"message", tls_min_version=>1, tls_max_version=>1.2, cipher_suites=>["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], client_inactivity_timeout=>60> Error: event executor terminated ``` Here is my updated filter config: ``` filter { if [document_type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:system.auth.hostname} sshd(?:\\[%{POSINT:system.auth.pid}\\])?: %{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user )?%{DATA:system.auth.user} from %{IPORHOST:system.auth.ip} port %{NUMBER:system.auth.port} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?"} } } } ``` ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [October 22, 2017, 1:59am UTC](https://discuss.elastic.co/t/grokking-the-linux-authorization-logs/104467/4 "2017-10-22T01:59:09Z")
Hi @magnusbaeck any help on the new error message I am seeing? Thanks in advance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 19, 2017, 1:59am UTC](https://discuss.elastic.co/t/grokking-the-linux-authorization-logs/104467/5 "2017-11-19T01:59:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.