# Parsing a lot of different syslogs using logstash

**URL:** https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324
**Category:** Logstash
**Created:** [July 31, 2018, 9:33am UTC](https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324 "2018-07-31T09:33:04Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 31, 2018, 12:09pm UTC](https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324/2 "2018-07-31T12:09:13Z")

</div>

That is a lot of different questions in one post!

I would start by parsing off the common fields using a dissect filter.

```
dissect { mapping => { "message" => "%{ts} %{+ts} %{hostname} %{packet-engine} : %{restOfLine}" } }

```

You appear to be using mutate to discard the timestamp, if you really do not want those fields then you can use

```
 dissect { mapping => { "message" => "%{} %{} %{hostname} %{packet-engine} : %{restOfLine}" } }
```

---

_[View the full topic](https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324)._