# Logstash and syslog messages from Cisco UCS

**URL:** <https://discuss.elastic.co/t/logstash-and-syslog-messages-from-cisco-ucs/84713>\
**Category:** Logstash\
**Created:** [May 5, 2017, 1:00pm UTC](https://discuss.elastic.co/t/logstash-and-syslog-messages-from-cisco-ucs/84713 "2017-05-05T13:00:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [May 5, 2017, 1:00pm UTC](https://discuss.elastic.co/t/logstash-and-syslog-messages-from-cisco-ucs/84713/1 "2017-05-05T13:00:31Z")

</div>

Hello, I've configured our Cisco UCS / Fabric Interconnect device to send its syslogs to Logstash, and using `tcpdump -n dst port 514` I can see that the devices are connecting to that port on the Logstash node. However, the index that I have configured for these messages does not appear to exist in Elasticsearch. I've posted the relevant sections of logstash.conf below:

```
input {

tcp {
    port => 514
    type => syslogucs
  }
   udp {
    port => 514
    type => syslogucs
  }

}

filter {

if [type] == "syslogucs" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
         }

     syslog_pri { }

     date {
                match => ["timestamp",
                        "MMM dd HH:mm:ss",
                        "MMM d HH:mm:ss",
                        "MMM dd yyyy HH:mm:ss",
                        "MMM d yyyy HH:mm:ss"
                ]
        }

}

output {

 if [type] == "syslogucs" {
   elasticsearch {
    hosts => ["192.168.56.226:9200", "192.168.52.251:9200", "192.168.52.252:9200"]
    index => ["syslogucs-%{+YYYY.MM}"]
   }

  }

}

```

If I go into Kibana is says it can't find the index pattern of "syslogucs-\*" - can anyone help?

Thanks.

---

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [May 5, 2017, 1:25pm UTC](https://discuss.elastic.co/t/logstash-and-syslog-messages-from-cisco-ucs/84713/2 "2017-05-05T13:25:11Z")

</div>

I've just taken a look in the /var/log/logstash/logstash-plain.log file and it show the following message repeatedly:

```
[2017-05-05T14:18:25,111][INFO][logstash.inputs.udp] Starting UDP listener {:address=>"0.0.0.0:514"}
[2017-05-05T14:18:25,111][WARN][logstash.inputs.udp] UDP listener died {:exception=>#<SocketError: bind: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:82:in `udp_listener'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:56:in `run'", "/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:425:in `inputworker'", "/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:419:in `start_input'"]}

```

I realised the inbuilt syslog daemon was listening on 514 and have now disabled it; I no longer see those messages in the Logstash log. I still can't see the index pattern but will keep checking and update this post.

---

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [May 5, 2017, 1:30pm UTC](https://discuss.elastic.co/t/logstash-and-syslog-messages-from-cisco-ucs/84713/3 "2017-05-05T13:30:38Z")

</div>

Problem fixed, I can now see the index so it was the inbuilt syslog daemon interfering with Logstash listening on port 514 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2017, 1:33pm UTC](https://discuss.elastic.co/t/logstash-and-syslog-messages-from-cisco-ucs/84713/4 "2017-06-02T13:33:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.