# Logstash - Syslog Help - I am a total pleb

**URL:** <https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957>\
**Category:** Logstash\
**Created:** [December 1, 2017, 3:27pm UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957 "2017-12-01T15:27:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![MalwareSandbox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malwaresandbox/32/24926_2.png) [@MalwareSandbox](https://discuss.elastic.co/u/MalwareSandbox)\
**Post date:** [December 1, 2017, 3:27pm UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957/1 "2017-12-01T15:27:56Z")

</div>

Hey Guys,

I am a noob when it comes to ELK but am really eager to get this set up. I am currently using ELK to store syslog from multiple firewalls. I am using a fortinet (which is seeming to be not that fun to work with). I am having all of the syslog from the Fortigate go to port 514, and attempting to have logstash parse the logs. I know the following thus far:

1. I am able to receive syslog on the Ubuntu instance on the server.
2. Kibana is successfully receiving logs from beats and able to parse them with a logstash parser that I set up (followed a tutorial video on youtube).
3. I cobbled together the franken-code below. Please let me know where you guys think I should look to go next. I have been playing around with configuration file for way too long... This is all in one file (which may be the problem?).

logstash conf file  
input {  
File {  
path =\> "/var/log/syslog"  
type =\> "syslog"  
start\_position =\> "beginning"  
}  
udp {  
port =\> 514  
type =\> "fortigate"  
}  
tcp {  
port =\> 514  
type =\> "fortigate"  
}  
}

# 

# Configure syslog filtering

# for the Fortigate firewall logs

# 

filter {  
if [type] == "fortigate" {  
mutate {  
add\_tag =\> ["fortigate"]  
}  
grok {  
match =\> ["message", "%{SYSLOG5424PRI:syslog\_index}%{GREEDYDATA:mes$  
overwrite =\> ["message"]  
tag\_on\_failure =\> ["failure\_grok\_fortigate"]  
}

```
    kv { }

    if [msg] {
        mutate {
            replace => ["message", "%{msg}"]
        }
    }
    mutate {
        add_field => ["logTimestamp", "%{date} %{time}"]
        add_field => ["loglevel", "%{level}"]
        replace => ["fortigate_type", "%{type}"]
        replace => ["fortigate_subtype", "%{subtype}"]
        remove_field => ["msg","type", "level", "date", "time"]
    }
    date {
        locale => "en"
        match => ["logTimestamp", "YYYY-MM-dd HH:mm:ss"]
        remove_field => ["logTimestamp", "year", "month", "day", "time", "d$
        add_field => ["type", "fortigate"]
    }
}#end if type fortigate

```

}

output {  
if ( [type] == "fortigate" ) {  
#stdout { codec =\> rubydebug }  
elasticsearch {  
index =\> "logstash\_fortigate-%{+YYYY.MM.dd}"  
host =\> ["localhost:9200"]  
protocol =\> "http"  
port =\> "443"  
}  
}

}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 2, 2017, 6:39pm UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957/2 "2017-12-02T18:39:01Z")

</div>

And what problem are you experiencing?

> host =\> ["localhost:9200"]  
> protocol =\> "http"  
> port =\> "443"

Port 443 is normally used for HTTPS. And what port do you want to use, 9200 or 443?

---

<div class="post-metadata">

**Author:** ![MalwareSandbox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malwaresandbox/32/24926_2.png) [@MalwareSandbox](https://discuss.elastic.co/u/MalwareSandbox)\
**Post date:** [December 4, 2017, 3:06pm UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957/3 "2017-12-04T15:06:35Z")

</div>

Thanks for the help Magnus!

I think 443 is best. The server is being hosted on my local device as is Kibana. But i also gave it my IP so that when you hit the IP in a web browser, it redirects to 80.

I guess I shoul've been clearer: I dont think logstash is parsing the data properly and I don't really know the best way to go about this for both Grok and the KV filter.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 4, 2017, 3:23pm UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957/4 "2017-12-04T15:23:21Z")

</div>

> I guess I shoul've been clearer: I dont think logstash is parsing the data properly and I don't really know the best way to go about this for both Grok and the KV filter.

Showing an example event produced by Logstash would be a good start. Comment out your elasticsearch output and use a `stdout { codec => rubydebug }` output for debugging purposes until the events look as expected.

---

<div class="post-metadata">

**Author:** ![MalwareSandbox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/malwaresandbox/32/24926_2.png) [@MalwareSandbox](https://discuss.elastic.co/u/MalwareSandbox)\
**Post date:** [December 4, 2017, 3:49pm UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957/5 "2017-12-04T15:49:28Z")

</div>

set it to be this -- still nothing populating in Kibana for me to visualize. Is it possible I shouldn't be looking in Kibana?

This is the code I currently have posted.

output {  
if ( [type] == "fortigate" ) {  
stdout { codec =\> rubydebug }  
#elasticsearch {  
#index =\> "logstash\_fortigate-%{+YYYY.MM.dd}"  
#host =\> ["localhost:9200"]  
#protocol =\> "http"  
#port =\> "443"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 5, 2017, 6:24am UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957/6 "2017-12-05T06:24:53Z")

</div>

The stdout output will dump the events in the Logstash log so that's where you should look.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2018, 6:25am UTC](https://discuss.elastic.co/t/logstash-syslog-help-i-am-a-total-pleb/109957/7 "2018-01-02T06:25:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.