# Logstash cmd displaying wrong output

**URL:** <https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938>\
**Category:** Logstash\
**Created:** [February 11, 2022, 6:40am UTC](https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938 "2022-02-11T06:40:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [February 11, 2022, 6:40am UTC](https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938/1 "2022-02-11T06:40:45Z")

</div>

Hi, I am new to ELK stack and I am trying to test out parsing sample syslog messages by following the steps mentioned on the official website --  
[https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_processing\_syslog\_messages](https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_syslog_messages)

This is my config file

```auto
input {
  tcp {
    port => 5000
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
  grok {
    match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
    add_field => ["received_at", "%{@timestamp}"]
    add_field => ["received_from", "%{host}"]
  }
  date {
    match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
   }
  }
}

output {
  elasticsearch { # output to ES
    hosts => ["localhost:9200"]
    index => "indexforsyslog1"
  }
  stdout { codec => "rubydebug" }
}

```

after I use telnet client and paste the sample syslog messages (given on website), I receive the following output on original logstash cell

```auto
{
          "tags" => [
        [0] "_grokparsefailure"
    ],
       "message" => "\u0016\r",
          "port" => 50792,
          "type" => "syslog",
      "@version" => "1",
          "host" => "0:0:0:0:0:0:0:1",
    "@timestamp" => 2022-02-11T06:38:56.126Z
}

```

I need help in figuring out why this happens and how to solve it to get the right output. Please help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2022, 6:41am UTC](https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938/2 "2022-03-11T06:41:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.