# Parsing syslog entries **URL:** \ **Category:** Logstash\ **Created:** [June 30, 2015, 6:02pm UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653 "2015-06-30T18:02:45Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![eacoimbra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eacoimbra/32/3518_2.png) [@eacoimbra](https://discuss.elastic.co/u/eacoimbra)\ **Post date:** [June 30, 2015, 6:02pm UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/1 "2015-06-30T18:02:45Z")
I'm trying to structure my mail logs using the pattern %SYSLOGLINE ([https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/linux-syslog](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/linux-syslog)). The parse is ok and I'm not getting grokparsefailure, but **syslog\_facility** and **syslog\_severity** always return **_user-level_** and **_notice_** , respectively. My filter section: ``` if [type] == "syslog" { grok { match => ["message", "%{SYSLOGLINE}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss"] locale => "en" timezone => "America/Sao_Paulo" } } ``` The result is something like these: ``` {"message":["<22>Jun 30 14:44:19 mail1 postfix/smtp[13428]: B2A1365441: to=, relay=10.10.10.69[10.10.10.69]:25, delay=0.56, delays=0.49/0/0/0.06, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as CB135192997)","B2A1365441: to=, relay=10.10.10.69[10.10.10.69]:25, delay=0.56, delays=0.49/0/0/0.06, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as CB135192997)"],"@version":"1","@timestamp":"2015-06-30T17:44:19.864Z","type":"syslog","host":"10.10.10.78","timestamp":"Jun 30 14:44:19","logsource":"mail1","program":"postfix/smtp","pid":"13428","syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"} {"message":["<22>Jun 30 14:44:19 mail1 postfix/qmgr[22929]: B2A1365441: removed","B2A1365441: removed"],"@version":"1","@timestamp":"2015-06-30T17:44:19.864Z","type":"syslog","host":"10.10.10.78","timestamp":"Jun 30 14:44:19","logsource":"mail1","program":"postfix/qmgr","pid":"22929","syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"} {"message":["<22>Jun 30 14:44:20 mail1 postfix/smtpd[14015]: connect from ng18-ip3.bullet.mail.ne1.yahoo.com[98.138.215.104]","connect from ng18-ip3.bullet.mail.ne1.yahoo.com[98.138.215.104]"],"@version":"1","@timestamp":"2015-06-30T17:44:20.036Z","type":"syslog","host":"10.10.10.78","timestamp":"Jun 30 14:44:20","logsource":"mail1","program":"postfix/smtpd","pid":"14015","syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"} {"message":["<22>Jun 30 14:44:20 mail1 postfix/smtpd[14012]: disconnect from ng21.bullet.mail.gq1.yahoo.com[67.195.87.64]","disconnect from ng21.bullet.mail.gq1.yahoo.com[67.195.87.64]"],"@version":"1","@timestamp":"2015-06-30T17:44:20.134Z","type":"syslog","host":"10.10.10.78","timestamp":"Jun 30 14:44:20","logsource":"mail1","program":"postfix/smtpd","pid":"14012","syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"} {"message":["<22>Jun 30 14:44:20 mail1 postfix/smtpd[13996]: disconnect from ng18-ip3.bullet.mail.ne1.yahoo.com[98.138.215.104]","disconnect from ng18-ip3.bullet.mail.ne1.yahoo.com[98.138.215.104]"],"@version":"1","@timestamp":"2015-06-30T17:44:20.142Z","type":"syslog","host":"10.10.10.78","timestamp":"Jun 30 14:44:20","logsource":"mail1","program":"postfix/smtpd","pid":"13996","syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"} ``` 1. How to properly collect severity and facility from syslog? 2. This \<22\> at the beginning of each message is normal? Regards, Emerson ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 30, 2015, 8:37pm UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/2 "2015-06-30T20:37:17Z")
> 1. How to properly collect severity and facility from syslog? Aren't you already getting the severity and facility in the syslog\_severity and syslog\_facility fields? > 1. This \<22\> at the beginning of each message is normal? That's the encoded severity and facility that the syslog\_pri filter extracts. ---
**Author:** ![eacoimbra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eacoimbra/32/3518_2.png) [@eacoimbra](https://discuss.elastic.co/u/eacoimbra)\ **Post date:** [July 1, 2015, 10:40am UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/3 "2015-07-01T10:40:06Z")
> Aren't you already getting the severity and facility in the syslog\_severity and syslog\_facility fields? Unfortunately not. After grok, logstash classifies all my mail logs with facility: USER-LEVEL and severity: NOTICE. Facility should be **MAIL** and severity in most cases **INFO**. I can force facility mail with mutate, but severity I can not predict what's coming... ☹ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 1, 2015, 11:49am UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/4 "2015-07-01T11:49:39Z")
Oh, right. By default the syslog\_pri filter tries to read the syslog\_pri\_field\_name field, but you're not extracting such a field from the payload. Otherwise it defaults to 13 (see code snippet below), which happens to be user-level/notice. You'll have to adjust your grok pattern slightly to extract a field that syslog\_pri can consume. > ---
**Author:** ![eacoimbra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eacoimbra/32/3518_2.png) [@eacoimbra](https://discuss.elastic.co/u/eacoimbra)\ **Post date:** [July 2, 2015, 10:06am UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/5 "2015-07-02T10:06:22Z")
Problem solved. Thanks Magnus! I took the example of Logstash documentation and made a small modification to identify the priority at the beginning of the message. ``` if [type] == "syslog" { grok { match => ["message", "<%{NONNEGINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ] } syslog_pri { } ``` I suggest to put **\<%{NONNEGINT:syslog\_pri}\>** in documentation example, because only with then the _syslog\_pri_ can properly capture the priority of the message. Otherwise, as you previously mentioned, _syslog\_pri_ always return 13 and it does not make any sense. 😄 ---
**Author:** ![cemanughianpeter](https://avatars.discourse-cdn.com/v4/letter/c/fbc32d/32.png) [@cemanughianpeter](https://discuss.elastic.co/u/cemanughianpeter)\ **Post date:** [February 7, 2017, 4:05pm UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/6 "2017-02-07T16:05:18Z")
Thanks for posting! I have the same problem and changed my logstash configuration file to add \<%{NONNEGINT:syslog\_pri}\> to my grok, but still not getting my severity to show up as non-notice. Here's my filter: ``` filter { if [type] == "syslog" { grok { match => { "message" => "<%{NONNEGINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ``` My messages are of this format: `<134>1 2015-01-01T11:12:23.180242-02:00 message` Anyone know why it's still showing up as notice in kibana? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/7 "2017-07-06T04:28:48Z")