# Logstash + Syslog + Security

**URL:** <https://discuss.elastic.co/t/logstash-syslog-security/288337>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [November 3, 2021, 2:44pm UTC](https://discuss.elastic.co/t/logstash-syslog-security/288337 "2021-11-03T14:44:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\
**Post date:** [November 3, 2021, 2:44pm UTC](https://discuss.elastic.co/t/logstash-syslog-security/288337/1 "2021-11-03T14:44:12Z")

</div>

Hello ELK gurus. I have been working on getting my first production ELK SIEM working and for the most part is it doing what is required. The one area that is really not functioning the way it needs is the Logstash and collection of syslogs. I am currently receiving the following Error message in the logstash-plain.log

> 

[2021-11-03T10:15:32,356][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "{" at line 24, column 9 (byte 584) after output {\n elasticsearch { hosts =\> ["10.12.36.52:9200"] }\n stdout {codec =\> rubydebug}\n user ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:389:in `block in converge\_state'"]}

My current logstash pipeline yml is as follows.

```auto
input {
  udp {
      port => ####
      type => syslog
  }
}
filter {
   if [type] == "syslog" {
     grok {
         match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[POSINT:syslog_pid}\]?: %{GREEDYDATA:syslog_message}" }
         add_field => ["received_at", "%{@timestamp}"]
         add_field => ["received_from", "%{host}"]
     }
     date {
         match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
       }
   }
}

output {
    elasticsearch { hosts => ["ip:add:es:9200"] }
    stdout {codec => rubydebug}
    user => "elastic"
    password => "es_password"
}

```

After restarting the logstash service and even swapping around the output user and password settings with the stdout line I am still presented with the message above. If I remove the user and password then I receive a 401 connection denied error.

Another set of eyes on this would be greatly appreciated.

Thank you.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 3, 2021, 3:29pm UTC](https://discuss.elastic.co/t/logstash-syslog-security/288337/2 "2021-11-03T15:29:04Z")

</div>

Your output config is wrong, the `user` and `password` shoud be inside the `elasticsearch` plugin configuration.

```auto
output {
    elasticsearch { 
        hosts => ["ip:add:es:9200"] 
        user => "elastic"
        password => "es_password"
    }
    stdout {codec => rubydebug}
}

```

---

<div class="post-metadata">

**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\
**Post date:** [November 3, 2021, 4:29pm UTC](https://discuss.elastic.co/t/logstash-syslog-security/288337/3 "2021-11-03T16:29:28Z")

</div>

Thank you, that worked to get me past that error message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2021, 4:29pm UTC](https://discuss.elastic.co/t/logstash-syslog-security/288337/4 "2021-12-01T16:29:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.