# Logstash parsing syslog
**URL:** https://discuss.elastic.co/t/logstash-parsing-syslog/57686
**Category:** Logstash
**Created:** [August 10, 2016, 10:48am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686 "2016-08-10T10:48:59Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@rth](https://discuss.elastic.co/u/rth)
#### Post date: [August 10, 2016, 10:48am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/1 "2016-08-10T10:48:59Z")
Hello all,
I have a syslog server and the ELK stack on the same server. I create a directory for each syslog source.
I'm trying to parse syslog events with Logstash, and I'd like to keep the ip adress of the syslog source in the "host" field. At the moment I have the 0.0.0.0 source after Logstash parsing.
could you please help ?
Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2016, 10:49am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/2 "2016-08-10T10:49:59Z")
Please show your configuration.
---
### Author:  [@rth](https://discuss.elastic.co/u/rth)
#### Post date: [August 10, 2016, 11:01am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/3 "2016-08-10T11:01:27Z")
Below the logstash.conf:
input {
file {
path =\> ["path/to/file.log"]
start\_position =\> "beginning"
type =\> "linux-syslog"
ignore\_older =\> 0
}
}
filter {
if [type] == "linux-syslog" {
grok {
match =\> {"message" =\> "\<%{POSINT:syslog\_pri}\>%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
}
}
}
output {
elasticsearch {
hosts =\> ["@IP\_Elastic:Port\_Elastic"]
}
stdout { codec =\> rubydebug }
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2016, 11:15am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/4 "2016-08-10T11:15:23Z")
The name of the host that generated each message should be present in the `syslog_hostname` field, right? If so, change your grok filter to store that string into the `host` field instead (you'll have to adjust the grok filter's `overwrite` option).
---
### Author:  [@rth](https://discuss.elastic.co/u/rth)
#### Post date: [August 10, 2016, 11:53am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/5 "2016-08-10T11:53:52Z")
Yes, indeed I'd like to keep the source ip or the name of the machine that generated the log because when I have a look at kibana, the "host" field is set to 0.0.0.0 for all the syslog sources. Moreover, the timestamp original is not kept, but only the timestamp of processing date by logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2016, 11:55am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/6 "2016-08-10T11:55:21Z")
> Moreover, the timestamp original is not kept, but only the timestamp of processing date by logstash.
Use a date filter to parse the `syslog_timestamp` field.
---
### Author:  [@rth](https://discuss.elastic.co/u/rth)
#### Post date: [August 10, 2016, 12:43pm UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/7 "2016-08-10T12:43:08Z")
Thank you magnus.
Is it possible to reuse the name of the syslog directory for the "host" field Logstash ?
For example, use the $HOST for the host field.
input {
file {
path =\> ["path/to/$HOST/file.log"]
start\_position =\> "beginning"
type =\> "linux-syslog"
ignore\_older =\> 0
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2016, 12:45pm UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/8 "2016-08-10T12:45:29Z")
Not like that, but you can use a grok filter to extract the hostname from the `path` field. Examples of this has been posted here and on StackOverflow many times.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686/9 "2017-07-06T04:44:01Z")