_grokparsefailure in Kibana tag (Synology messages)

Elastic Stack Logstash
1

Hi,

I recieve a _grokparsefailure in Kibana tags but all the fields are splitted correct. How can I remove the grokparsefailure for those incomming messages?

   if [logsource] == "BackupStation" {
     mutate {
       add_tag => [ "SynologyBackupstation" ]
       }

      kv  {
               value_split => ":"
               field_split => ","
       }
  }

How could I track that failure down to the problem from where it is comming from?

2

Show an example event that exhibits the problem. Copy/paste from Kibana's JSON tab.

3

Hi Magnus,

No problem:

{
  "_index": "logstash-2017.12.13",
  "_type": "syslog",
  "_id": "ArxpUGABKDf7kXJ8cWPV",
  "_version": 1,
  "_score": null,
  "_source": {
    "severity": 6,
    " User": "Marc XXXXX",
    "syslog_severity_code": 5,
    "syslog_facility": "user-level",
    " IP": "192.168.0.29\n",
    "syslog_facility_code": 1,
    " Size": "3.07 MB",
    "message": "WinFileService Event: read, Path: /Privat Marc XXX/Eigene Dateien/Weiterbildung/XXXXX/5. Semester/Führung und Personalmanagement/Gruppenarbeit/XXXXX.docx, File/Folder: File, Size: 3.07 MB, User: Marc XXX, IP: 192.168.0.29\n",
    "type": "syslog",
    "priority": 14,
    "logsource": "Titanserver",
    " Path": "/Privat Marc XXXX/Eigene Dateien/Weiterbildung/Dipl. XXXX/5. Semester/Führung und Personalmanagement/Gruppenarbeit/ParkSpace4U.docx",
    "syslog_severity": "notice",
    "tags": [
      "syslog",
      "_grokparsefailure",
      "SynologyTitanserver"
    ],
    "WinFileService Event": "read",
    "@timestamp": "2017-12-13T15:06:15.000Z",
    "@version": "1",
    "host": "192.168.0.20",
    " File/Folder": "File",
    "facility": 1,
    "severity_label": "Informational",
    "timestamp": "Dec 13 16:06:15",
    "facility_label": "user-level"
  },
  "fields": {
    "@timestamp": [
      "2017-12-13T15:06:15.000Z"
    ]
  },
  "highlight": {
    "logsource": [
      "@kibana-highlighted-field@Titanserver@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1513177575000
  ]
}

For this Synology Server I have the same filter as above.

4

What does your full configuration look like?

5

I sent you a link for downloading the files.

6

I only spend time on publicly posted questions and details so please post the link publicly.

7

Okey here is the link for downloading all the configuration files.

https://mega.nz/#!QbxFBYza!00uFmeOn5QM9irEORlMSpiqOnfhNxap52YPgVgSdg5Y

8

Nothing obviously wrong there. You don't have any extra files in /etc/logstash/conf.d apart from the five .conf files you included in the archive? What does an example input syslog event look like?

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.