Parse logstash - rfc5424

[Paulogbr (Joao PG)]

Hello guys, I need help to parse the syslog RFC 5424 with logstash.

<190> 1 2020-11-28T14:18:03-02:00 workstantion1030.teste.corp WSEE - - [message@01-] @cee:{"type":"1","timestamp":"4698753981054","host_name":"","user_name":"","time":"1606666683","EventContextType":"0","rtid"

I Try this:

input {
  udp {
    port => "5160"
    type => "syslog"
  }
}

filter {
    if [type] == "syslog" {
        grok {
            match => {
                "message" => "<%{NONNEGINT:syslog_pri} %{NONNEGINT:version}%{GREEDYDATA:syslog_message})"
            }

But i have error because the ( <190> 1 ), can you help me ?

[Badger]

You are missing the > after syslog_pri.

[Paulogbr (Joao PG)]

Thanks, that Works.

Can you help about parse the @cee ?

I can try %{DATA:message_01}:cee , but i think the problem is "@".

[Badger]

There is no colon preceding cee, but you have one in your pattern.