# Parsing FreeBSD syslog

**URL:** <https://discuss.elastic.co/t/parsing-freebsd-syslog/97647>\
**Category:** Logstash\
**Created:** [August 19, 2017, 3:40am UTC](https://discuss.elastic.co/t/parsing-freebsd-syslog/97647 "2017-08-19T03:40:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bane](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bane](https://discuss.elastic.co/u/bane)\
**Post date:** [August 19, 2017, 3:40am UTC](https://discuss.elastic.co/t/parsing-freebsd-syslog/97647/1 "2017-08-19T03:40:21Z")

</div>

Hi,

I am trying to parse FreeBSD syslog. The syslogs are sent to logstash via filebeat. I currently use this grok:

> filter {  
> if [type] == "syslog" {
> 
> ```
> grok {
> match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
> add_field => ["received_at", "%{@timestamp}"]
> add_field => ["received_from", "%{host}"]
> }
> 
> syslog_pri { }
> 
> date {
> match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
> }
> 
> ```
> 
> }  
> }

and the output of this is:

> {  
> "\_index": "filebeat-2017.08.17",  
> "\_type": "syslog",  
> "\_id": "AV3wahQdJ57xNwGFxihH",  
> "\_version": 1,  
> "\_score": null,  
> "\_source": {  
> "syslog\_severity\_code": 5,  
> "offset": 41691,  
> "syslog\_facility": "user-level",  
> "input\_type": "log",  
> "syslog\_facility\_code": 1,  
> "source": "/var/log/messages",  
> "message": "Aug 17 23:37:42 \<security.notice\> Server auditd[637]: renamed /var/audit/20170817133611.not\_terminated to /var/audit/20170817133611.20170817133742",  
> "type": "syslog",  
> "syslog\_severity": "notice",  
> "tags": [  
> "beats\_input\_codec\_plain\_applied",  
> "\_grokparsefailure"  
> ],  
> "@timestamp": "2017-08-17T13:37:46.318Z",  
> "@version": "1",  
> "beat": {  
> "hostname": "Server.local",  
> "name": "Server.local",  
> "version": "5.5.1"  
> },  
> "host": "Server.local",  
> "fields": {  
> "system\_type": "File Server",  
> "operating\_system": "FreeBSD"  
> }  
> },  
> "fields": {  
> "@timestamp": [  
> 1502977066318  
> ]  
> },  
> "sort": [  
> 1502977066318  
> ]  
> }

I know why the filter doesn't work. FreeBSD syslog messages look like the following:

> Aug 17 23:37:42 \<security.notice\> Server auditd[637]: renamed /var/audit/20170817133611.not\_terminated to /var/audit/20170817133611.20170817133742

The facility and severity are not being correctly parsed. the are located between the \<\>. I'm not sure how to fix the grok filter to accomodate this.

Can anyone help me fix my filter to correctly parse FreeBSD syslogs

Many thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2017, 3:40am UTC](https://discuss.elastic.co/t/parsing-freebsd-syslog/97647/2 "2017-09-16T03:40:52Z")

</div>

Closed on September 16, 2017, 3:40am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.