# Log Parsing

**URL:** <https://discuss.elastic.co/t/log-parsing/249255>\
**Category:** Logstash\
**Created:** [September 20, 2020, 12:22pm UTC](https://discuss.elastic.co/t/log-parsing/249255 "2020-09-20T12:22:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mansa](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mansa](https://discuss.elastic.co/u/mansa)\
**Post date:** [September 20, 2020, 12:22pm UTC](https://discuss.elastic.co/t/log-parsing/249255/1 "2020-09-20T12:22:31Z")

</div>

Actually we have two variety of logs.

1. Syslogs which comes from Linux device ( start with time)
2. Syslog but comes from cisco devices

Logs which comes from cisco device start with hostname and logs which comes from linux start with time so i want to send the logs which comes from cisco device to different port so how do i filter like if my logs start with hostname it should go to differnt port (other then configure for linux device)?

what if or else statment or any other way which pick if logs start with hostname then it should go port "6514"  
Please advise.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 20, 2020, 9:50pm UTC](https://discuss.elastic.co/t/log-parsing/249255/2 "2020-09-20T21:50:44Z")

</div>

Welcome to our community! 😃

Logstash cannot redirect events until they have been received. You will need to tell your Cisco devices to send to a specific endpoint, and then configure your hosts to send to another.

---

<div class="post-metadata">

**Author:** ![mansa](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mansa](https://discuss.elastic.co/u/mansa)\
**Post date:** [September 21, 2020, 3:57am UTC](https://discuss.elastic.co/t/log-parsing/249255/3 "2020-09-21T03:57:31Z")

</div>

Hello Dear

yes we are getting logs at logstash as per below  
Format 1  
Msg: Sep 15 18:14:49 Servername cupsd[1317]: REQUEST localhost - - "POST / HTTP/1.1" 200 184 Renew-Subscription successful-ok\0x0a

Format2  
Msg: 73166:bsy-lup11-4938: Sep 16 17:42:27: %SYS-5-CONFIG\_I: Configured from console by cyberark\_admin on vty0 (XX.34.XX.240)

Now my requirement is that if logs start with host name it should go to the different port (foramat2) and log start with time stamp it should go to different port as output how do i do that ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 21, 2020, 4:42am UTC](https://discuss.elastic.co/t/log-parsing/249255/4 "2020-09-21T04:42:30Z")

</div>

As output to where?

---

<div class="post-metadata">

**Author:** ![mansa](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mansa](https://discuss.elastic.co/u/mansa)\
**Post date:** [September 21, 2020, 9:10am UTC](https://discuss.elastic.co/t/log-parsing/249255/5 "2020-09-21T09:10:39Z")

</div>

We are sending output to our one of they server (Mcafee receiver)  
let say 10.x.x.x etc...we need to forward to it but for type 1 log should to go to port 514 or type 2 go to 6514 etc...so how to we configure this.

Note : our input is same ( end nodes are forwarding to logstash)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 21, 2020, 2:04pm UTC](https://discuss.elastic.co/t/log-parsing/249255/6 "2020-09-21T14:04:08Z")

</div>

You could do something like

```
output {
    if [message] =~ /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/ {
        ...
    } else {
        ...
    }
}

```

to choose between two outputs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2020, 2:04pm UTC](https://discuss.elastic.co/t/log-parsing/249255/7 "2020-10-19T14:04:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.