Parse logstash - rfc5424

Elastic Stack Logstash
1

Hello guys, I need help to parse the syslog RFC 5424 with logstash.

<190> 1 2020-11-28T14:18:03-02:00 workstantion1030.teste.corp WSEE - - [message@01-] @cee:{"type":"1","timestamp":"4698753981054","host_name":"","user_name":"","time":"1606666683","EventContextType":"0","rtid"

I Try this:

input {
  udp {
    port => "5160"
    type => "syslog"
  }
}

filter {
    if [type] == "syslog" {
        grok {
            match => {
                "message" => "<%{NONNEGINT:syslog_pri} %{NONNEGINT:version}%{GREEDYDATA:syslog_message})"
            }

But i have error because the ( <190> 1 ), can you help me ?

2

You are missing the > after syslog_pri.

1 Like
3

Thanks, that Works.

Can you help about parse the @cee ?

testev2
testev21080×448 36.3 KB

I can try %{DATA:message_01}:cee , but i think the problem is "@".

4

There is no colon preceding cee, but you have one in your pattern.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.