# How to parse IP address from file /var/log/syslog in Logstash 10-syslog-conf
**URL:** https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701
**Category:** Logstash
**Created:** [November 27, 2015, 3:31am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701 "2015-11-27T03:31:04Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@lewis151](https://discuss.elastic.co/u/lewis151)
#### Post date: [November 27, 2015, 3:31am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/1 "2015-11-27T03:31:04Z")
Time file syslog\_message syslog\_program received\_from
November 26th 2015, 18:00:49.000 /var/log/syslog Invalid response packet from host 131.247.30.106.
avahi-daemon xen3ubut14dt-0
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 27, 2015, 4:55am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/2 "2015-11-27T04:55:45Z")
Some more information would be useful.
What is your current configuration? What version are you on?
---
### Author:  [@lewis151](https://discuss.elastic.co/u/lewis151)
#### Post date: [November 27, 2015, 1:10pm UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/3 "2015-11-27T13:10:34Z")
I am as bad as my users, not supplying enough information
Ubuntu 14.04
Elasticsearch 2.0.0
Logstash 2.0.0
Kibana 4.2.0
The Kibana Discover columns
1.) Time November 26th 2015, 18:00:49.000
2.) file /var/log/syslog
3.) syslog\_message Invalid response packet from host 131.247.30.106
4.) syslog\_program avahi-daemon
5.) received\_from xen3ubut14dt-0
None of the Available Fields have anything close to an IP Address only from the message field.
---
### Author:  [@lewis151](https://discuss.elastic.co/u/lewis151)
#### Post date: [November 27, 2015, 1:16pm UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/4 "2015-11-27T13:16:42Z")
Logstash config
```
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:host_target} logname=%{USERNAME:logname} sshd\[BASE10NUM}\]: Failed password for (invalid user |)%{USERNAME:username} from %{IP:src_ip} port %{BASE10NUM:port} ssh2 %{SYSLOGHOST:syslog_hostname} tty=%{TTY:tty} ruser=%{USERNAME:ruser} rhost=(?:%{HOSTNAME:remote_host}|\s*) user=%{USERNAME:user} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => ["received_at", "%{@timestamp}"]
add_field => ["received_from", "%{host}"]
add_field => ["src_ip", "%{clientip}"]
}
```
# filter {
# if [type] == "syslog" {
# grok {
# }
# grok {
# type =\> "syslog"
# match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME:host\_target} logname=%{USERNAME:logname} uid=%{BASE10NUM:uid} euid=%{BASE10NUM:euid} tty=%{TTY:tty} ruser=%{USERNAME:ruser} rhost=(?:%{HOSTNAME:remote\_host}|\s\*) user=%{USERNAME:user}" }
# add\_tag =\> "sudo\_auth\_failure"
#}
# grok {
# type =\> "syslog"
# pattern =\> "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host\_target} sshd[%{BASE10NUM}]: Failed password for %{USERNAME:username} from %{IP:src\_ip} port %{BASE10NUM:port} ssh2"
# add\_tag =\> "ssh\_failed\_login"
#}
# grok {
# type =\> "syslog"
# pattern =\> "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host\_target} sshd[%{BASE10NUM}]: Accepted password for %{USERNAME:username} from %{IP:src\_ip} port %{BASE10NUM:port} ssh2"
# add\_tag =\> "ssh\_sucessful\_login"
#}
```
syslog_pri { }
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
```
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 27, 2015, 11:18pm UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/5 "2015-11-27T23:18:14Z")
That's really difficult to read, can you please edit and use the code formatting on your config.
---
### Author:  [@lewis151](https://discuss.elastic.co/u/lewis151)
#### Post date: [November 28, 2015, 1:09am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/6 "2015-11-28T01:09:15Z")
I am a novice at this I do not know how to use code formatting. I found formatting is color coding with a special character created by alt+21 and a letter for the color, §e for yellow. Can you point me to an example?
Thanks.
Lewis Litchfield
Technology Services - Viking Center Lab
University of South Florida Sarasota-Manatee
941-359-4231
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 28, 2015, 1:11am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/7 "2015-11-28T01:11:18Z")
You can format highlighted text by using the buttons at the top of the text box.
---
### Author:  [@lewis151](https://discuss.elastic.co/u/lewis151)
#### Post date: [November 28, 2015, 1:53am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/8 "2015-11-28T01:53:34Z")
Is this what you are looking for? 10-syslog.conf follows:
_filter {_
-
```
if [type] == "syslog" {*
```
-
```
grok {*
```
-
```
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:host_target} logname=%{USERNAME:logname} sshd\[BASE10NUM}\]: Failed password for (invalid user |)%{USERNAME:username} from %{IP:src_ip} port %{BASE10NUM:port} ssh2 %{SYSLOGHOST:syslog_hostname} tty=%{TTY:tty} ruser=%{USERNAME:ruser} rhost=(?:%{HOSTNAME:remote_host}|\s*) user=%{USERNAME:user} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }*
```
-
```
add_field => ["received_at", "%{@timestamp}"]*
```
-
```
add_field => ["received_from", "%{host}"]*
```
-
```
add_field => ["src_ip", "%{clientip}"]*
```
-
```
}*
```
_}_
-
```
syslog_pri { }*
```
-
```
date {*
```
-
```
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]*
```
-
```
}*
```
-
```
}*
```
- }\*
_strong text_
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701/9 "2017-07-06T05:20:57Z")