# Parsing Syslog with Logstash Grock Filter isn't working with Kibana

**URL:** <https://discuss.elastic.co/t/parsing-syslog-with-logstash-grock-filter-isnt-working-with-kibana/278844>\
**Category:** Logstash\
**Created:** [July 16, 2021, 2:51am UTC](https://discuss.elastic.co/t/parsing-syslog-with-logstash-grock-filter-isnt-working-with-kibana/278844 "2021-07-16T02:51:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![olg32](https://avatars.discourse-cdn.com/v4/letter/o/35a633/32.png) [@olg32](https://discuss.elastic.co/u/olg32)\
**Post date:** [July 16, 2021, 2:51am UTC](https://discuss.elastic.co/t/parsing-syslog-with-logstash-grock-filter-isnt-working-with-kibana/278844/1 "2021-07-16T02:51:40Z")

</div>

Hi,

I have crated a very basic grok filter to parse Cisco Syslogs:

```auto
input {
  udp {
    port => 5140
    type => syslog
      }
 }

filter {
    grok {
        match => { "message"=> "%{TIMESTAMP_ISO8601:Timestamp_Local} %{IPV4:IP_Address} %{GREEDYDATA:Event}" }
         }
       }

output {
    elasticsearch {
      hosts => ["localhost:9200"]
      sniffing => true
      index => "ciscologs-%{+YYYY.MM.dd}"
       }

 }

```

After reloading Logstash and verifying that logs show no major issues I reloaded Kibana and refreshed indexes.

When accessing the Discovery section, I saw that the index was indeed created. But looking at the fields, they were the default ones and not the ones defined in the grok filter.

The logs received after adding the filter show the following tag in Kibana:

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/1/7/171e83bd45353269274cd27abc8579b07f5d5bad.jpeg)

Before adding the filter I made sure it works using Kibana's Grok debugger.  
The tag states that there was a problem with the logs parsing but at this point I'm not sure where the issue might be, so, any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [July 16, 2021, 6:11am UTC](https://discuss.elastic.co/t/parsing-syslog-with-logstash-grock-filter-isnt-working-with-kibana/278844/2 "2021-07-16T06:11:44Z")

</div>

You specify an `IPV4` in the grok filter, but your log doesn't contain an IP address.  
You also specify `TIMESTAMP_ISO8601`, but your log doesn't contain an ISO 8601 timestamp.

---

<div class="post-metadata">

**Author:** ![olg32](https://avatars.discourse-cdn.com/v4/letter/o/35a633/32.png) [@olg32](https://discuss.elastic.co/u/olg32)\
**Post date:** [July 17, 2021, 12:48am UTC](https://discuss.elastic.co/t/parsing-syslog-with-logstash-grock-filter-isnt-working-with-kibana/278844/3 "2021-07-17T00:48:45Z")

</div>

Thanks, in fact I found the problem. I was trying to match the Syslog coming from the router and not the logs in "message" After modifying that, the filter worked just fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2021, 12:48am UTC](https://discuss.elastic.co/t/parsing-syslog-with-logstash-grock-filter-isnt-working-with-kibana/278844/4 "2021-08-14T00:48:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.