# Making the best of an existing Syslog stream

**URL:** <https://discuss.elastic.co/t/making-the-best-of-an-existing-syslog-stream/195662>\
**Category:** Logstash\
**Created:** [August 18, 2019, 9:27pm UTC](https://discuss.elastic.co/t/making-the-best-of-an-existing-syslog-stream/195662 "2019-08-18T21:27:47Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 18, 2019, 9:51pm UTC](https://discuss.elastic.co/t/making-the-best-of-an-existing-syslog-stream/195662/2 "2019-08-18T21:51:21Z")

</div>

I would start with finding out whether you can use a syslog input. Syslog is many things to many people. A syslog input expects RFC 3164 messages. Otherwise you would might use a TCP input. (Or there was a recent [post](https://discuss.elastic.co/t/newb-rsyslogd-vs-logstash-question/195398) suggesting using rsyslog to talk to all those syslog daemons and forward to logstash.)

If you need to selectively apply a multiline codec you may want to have multiple pipelines. Have your main pipeline figure out what multiline treatment based on host or a pattern match or whatever then use tcp output/input pairs to apply the multiline codec. If you cannot get multiline it might be possible to use aggregate, but any pipelines running aggregate are restricted to a single pipeline worker thread (also, you want pipeline.java\_execution set to false in logstash.yml until [this](https://github.com/elastic/logstash/issues/10938) bug is fixed).

In a past experience taking on several new data feeds at the same time I found it helpful to tag data once I thought it was being parsed correctly and feed that to a different index. All the stuff that had not been parsed properly was fed into a 'fixme' index.

---

_[View the full topic](https://discuss.elastic.co/t/making-the-best-of-an-existing-syslog-stream/195662)._