# Parse logstash - rfc5424

**URL:** <https://discuss.elastic.co/t/parse-logstash-rfc5424/256992>\
**Category:** Logstash\
**Created:** [November 29, 2020, 4:24pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992 "2020-11-29T16:24:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paulogbr](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\
**Post date:** [November 29, 2020, 4:24pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992/1 "2020-11-29T16:24:02Z")

</div>

Hello guys, I need help to parse the syslog RFC 5424 with logstash.

`<190> 1 2020-11-28T14:18:03-02:00 workstantion1030.teste.corp WSEE - - [message@01-] @cee:{"type":"1","timestamp":"4698753981054","host_name":"","user_name":"","time":"1606666683","EventContextType":"0","rtid"`

I Try this:

```
input {
  udp {
    port => "5160"
    type => "syslog"
  }
}

filter {
    if [type] == "syslog" {
        grok {
            match => {
                "message" => "<%{NONNEGINT:syslog_pri} %{NONNEGINT:version}%{GREEDYDATA:syslog_message})"
            }

```

But i have error because the ( \<190\> 1 ), can you help me ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 29, 2020, 7:30pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992/2 "2020-11-29T19:30:47Z")

</div>

You are missing the \> after syslog\_pri.

---

<div class="post-metadata">

**Author:** ![Paulogbr](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\
**Post date:** [November 30, 2020, 4:25pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992/3 "2020-11-30T16:25:33Z")

</div>

Thanks, that Works.

Can you help about parse the @cee ?

 ![testev2](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e94ffb6d78b4fb93020c9f23eddaaec847978b4d.jpeg)

I can try %{DATA:message\_01}:cee , but i think the problem is "@".

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 30, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992/4 "2020-11-30T16:35:25Z")

</div>

There is no colon preceding cee, but you have one in your pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parse-logstash-rfc5424/256992/5 "2020-12-28T16:35:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.