# Logstash, filebeat, syslog rfc5424 not working

**URL:** <https://discuss.elastic.co/t/logstash-filebeat-syslog-rfc5424-not-working/212516>\
**Category:** Logstash\
**Tags:** beats-module\
**Created:** [December 19, 2019, 4:10pm UTC](https://discuss.elastic.co/t/logstash-filebeat-syslog-rfc5424-not-working/212516 "2019-12-19T16:10:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Willl](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@Willl](https://discuss.elastic.co/u/Willl)\
**Post date:** [December 19, 2019, 4:11pm UTC](https://discuss.elastic.co/t/logstash-filebeat-syslog-rfc5424-not-working/212516/1 "2019-12-19T16:11:00Z")

</div>

Hi,

I have ELK 7.5.0 setup on one node with a few other systems running auditbeat and filebeat. I have SSL setup for communication between the beat and logstash. I have filebeat specified to look at /var/log/messages. Only the Time, "host.hostname" and message columns are populated in the [Filebeat System} ECS dashboard. The "message" column is populated with the full message as it is in syslog. I don't know what did I miss.

All syslog from clients are set to RFC5242 (syslog uses $ActionFileDefaultTemplate RSYSLOG\_FileFormat)

I tried, the followings, but I can't seem to get the process name working. I think because of this, I don't get any data populated for Sudo and SSH logins also.

if [event.dataset] == "system.syslog"  
if [type] == "syslog"

logstash/conf.d/logstash.conf is set as below.

> Blockquote  
> input {  
> beats {  
> port =\> 5044  
> ssl =\> true  
> ssl\_certificate\_authorities =\> ["/etc/logstash/ssl/ca.crt"]  
> ssl\_certificate =\> "/etc/logstash/ssl/xxxxxx.crt"  
> ssl\_key =\> "/etc/logstash/ssl/xxxxxx.key"  
> ssl\_verify\_mode =\> "peer"  
> }  
> }  
> filter {  
> if [type] == "syslog" {  
> grok {  
> match =\> { "message" =\> "%{SYSLOGLINE}"}  
> }  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
> index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
> }  
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2020, 4:11pm UTC](https://discuss.elastic.co/t/logstash-filebeat-syslog-rfc5424-not-working/212516/2 "2020-01-16T16:11:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.