# Logstash reading syslog from filebeat

**URL:** https://discuss.elastic.co/t/logstash-reading-syslog-from-filebeat/272354
**Category:** Logstash
**Created:** [May 7, 2021, 2:41am UTC](https://discuss.elastic.co/t/logstash-reading-syslog-from-filebeat/272354 "2021-05-07T02:41:43Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![lachlan.simpson](https://avatars.discourse-cdn.com/v4/letter/l/50afbb/32.png) [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)
#### Post date: [May 7, 2021, 2:41am UTC](https://discuss.elastic.co/t/logstash-reading-syslog-from-filebeat/272354/1 "2021-05-07T02:41:43Z")

</div>

Using RHEL8, ELK 7.12, I have filebeat 7.12 set up on a RH7 workstation, configured with the syslog plugin and delivering data to logstash.

The data is coming into logstash, but it's raw - the message field isn't being split up. I am presuming that one of the plugins will be designed with most of the main syslog patterns? Is that the purpose of the plugins?

Now I'm confused about what type of plugin to use for logstash - I know that the input is `beats`, so I presume I don't want the `logstash-input-syslog`. Maybe `logstash-filter-syslog-pri`?

Is this a sufficient `filebeat-syslog.conf`?

```auto
input {
  beats {
    port => "5044" 
  }
}
filter {
  syslog_pri {
  }
}

```

Or do I need to add an if check?

```auto
filter {
  if [type] == "syslog" {
    syslog_pri {
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![lachlan.simpson](https://avatars.discourse-cdn.com/v4/letter/l/50afbb/32.png) [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)
#### Post date: [May 7, 2021, 4:22am UTC](https://discuss.elastic.co/t/logstash-reading-syslog-from-filebeat/272354/2 "2021-05-07T04:22:11Z")

</div>

Ok, so the answer is no - `logstash-filter-syslog_pri` is only for SYSLOG priorities. Doesn't break down the actual message.

I need to use `logstash-filter-grok`? Yes, that seems to have worked.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 4, 2021, 4:22am UTC](https://discuss.elastic.co/t/logstash-reading-syslog-from-filebeat/272354/3 "2021-06-04T04:22:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.