# Parsing for syslog in Filebeat

**URL:** <https://discuss.elastic.co/t/parsing-for-syslog-in-filebeat/242314>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 23, 2020, 9:44am UTC](https://discuss.elastic.co/t/parsing-for-syslog-in-filebeat/242314 "2020-07-23T09:44:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![misheck](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@misheck](https://discuss.elastic.co/u/misheck)\
**Post date:** [July 23, 2020, 9:44am UTC](https://discuss.elastic.co/t/parsing-for-syslog-in-filebeat/242314/1 "2020-07-23T09:44:39Z")

</div>

I have filebeat installed on a Centos vm to collect local logs via flat file and also receive syslog on Port 9000 from a remote Centos Machine.

I am collecting logs from computers but I have noticed that the Filebeat ECS dashboards only gets populated using the local logs and not the syslog from the remote machine. A comparison of the logs when looking at the Sudo Commands dashboard shows that the syslog does **system.auth.sudo.command** , this is being entered into the message fields.

I am using rsyslog and this is how rsyslog file is configured  
`*.*	@@192.168.56.133:9000`

Is there anything I need to do to make the syslog files get formatted in the same way that the local logs are being formatted?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2020, 11:44am UTC](https://discuss.elastic.co/t/parsing-for-syslog-in-filebeat/242314/2 "2020-08-20T11:44:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.