# Parsing syslog entries

**URL:** <https://discuss.elastic.co/t/parsing-syslog-entries/24653>\
**Category:** Logstash\
**Created:** [June 30, 2015, 6:02pm UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653 "2015-06-30T18:02:45Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![eacoimbra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eacoimbra/32/3518_2.png) [@eacoimbra](https://discuss.elastic.co/u/eacoimbra)\
**Post date:** [July 2, 2015, 10:06am UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653/5 "2015-07-02T10:06:22Z")

</div>

Problem solved. Thanks Magnus!

I took the example of Logstash documentation and made a small modification to identify the priority at the beginning of the message.

```
  if [type] == "syslog" {

    grok {
      match => ["message", "<%{NONNEGINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
    }

    syslog_pri { }

```

I suggest to put **\<%{NONNEGINT:syslog\_pri}\>** in documentation example, because only with then the _syslog\_pri_ can properly capture the priority of the message. Otherwise, as you previously mentioned, _syslog\_pri_ always return 13 and it does not make any sense.

😄

---

_[View the full topic](https://discuss.elastic.co/t/parsing-syslog-entries/24653)._