# Problem with my logstash file '.conf' for analyse syslog from my switchs **URL:** \ **Category:** Logstash\ **Created:** [March 28, 2023, 7:10pm UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750 "2023-03-28T19:10:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Son\_Goku](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/son_goku/32/118887_2.png) [@Son\_Goku](https://discuss.elastic.co/u/Son_Goku)\ **Post date:** [March 28, 2023, 7:10pm UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750/1 "2023-03-28T19:10:57Z")
Hello, I have install ELK stack 8.6 with elasticsearch, Logstash, Kibana, Filebeat and Metricbeats; Well ! I tested my server with a Logstash file "syslog.conf" with a beats input, who listen on 5044 port. It works, I see my logs correctly. But, now I want analyse syslog on 514 port, for monitoring my swiths HP 5140, and I don't know how I can do it . Can you help me for fix my problem. Thanks. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 29, 2023, 10:26am UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750/2 "2023-03-29T10:26:06Z")
You need .conf similar to this: ```auto input { syslog { port => 514 } } filter { # later will add grok like SYSLOGLINE or similar parser } output { file { path => "/path/hpsyslog_%{+YYYY-MM-dd}.txt" } stdout { codec => rubydebug{ } } } ``` The message should be like this: `<189>Oct 9 14:59:04 2022 Sysname %%10SHELL/5/SHELL_LOGIN(l): VTY logged in from 192.168.1.1` Check the received messages and the documentation to get fields description. The grok conf should be like [this](https://discuss.elastic.co/t/hp-procurve-switch-log-files-not-showing/33976). ---
**Author:** ![Son\_Goku](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/son_goku/32/118887_2.png) [@Son\_Goku](https://discuss.elastic.co/u/Son_Goku)\ **Post date:** [March 29, 2023, 12:56pm UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750/3 "2023-03-29T12:56:58Z")
Hi, Thanks for your help, actually it work, I saw my syslog in Kibana. But, when I want see "who send me syslog ?" I see the ip of my interface and not ip of my switch. It's a problem because I want monitor a lot of switchs and I want know who has a problem; In clear, know what they do on my network. My .conf file it's : ```auto input { syslog { port => 514 } } filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } output { elasticsearch { hosts => ["localhost:9200"] index => "switch_logs-%{+YYYY.MM.dd}" stdout { codec => rubydebug{ } } } } ``` And I have create a vlan in my interface for receive Syslog from my switchs : ```auto vlans.30@enp1s0: group default qlen 1000 inet 10.128.2.244/22 brd 10.128.3.255 scope global vlans.30 ``` What I see on Kibana : ![Capturedvsdf](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7ea803997c4983c23e0b064370d11d994be74565.png) It's the same Ip of my interface. And I don't know how I can fix my problem. Thanks again for your help. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [March 29, 2023, 1:54pm UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750/4 "2023-03-29T13:54:31Z")
Good. 👍 _syslog\_hostname_ - is what syslog message contains, I would leave as it is. _logsource or log.syslog_ or similar - should be also there as an independent field, this is IP/hostname of device which is sending data. I think you should configure device to use only single IP for forwarding. Check full JSON document which are additional fields, it's visible in Kibana. _host_ - which receive data. The address to listen on. _syslog\_timestamp_ - is actually a real @timestamp from your log source, you should use `date` for formatting. Currently you are using @timestamp as Logstash getdate(). ```auto date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] # put correct format } ``` Also, you can even put grok pattern inside [input](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html#plugins-inputs-syslog-syslog_field) ---
**Author:** ![Son\_Goku](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/son_goku/32/118887_2.png) [@Son\_Goku](https://discuss.elastic.co/u/Son_Goku)\ **Post date:** [March 29, 2023, 3:29pm UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750/5 "2023-03-29T15:29:43Z")
I didn't understand everything, I should delete the timestamp in my gok filter an add 'date' ? For example, my switch's syslogs seems to : ```auto %Feb 27 16:48:01:854 2013 HP5140-Bat-3-3 IFNET/3/PHY_UPDOWN: Physical state on the interface GigabitEthernet1/0/2 changed to up. %Feb 27 16:48:01:855 2013 HP5140-Bat-3-3 IFNET/5/LINK_UPDOWN: Line protocol state on the interface GigabitEthernet1/0/2 changed to up. %Feb 27 16:48:17:807 2013 HP5140-Bat-3-3 LLDP/6/LLDP_CREATE_NEIGHBOR: Nearest bridge agent neighbor created on port GigabitEthernet1/0/2 (IfIndex 2), neighbor's chassis ID is 482a-e37c-a954, port ID is 482a-e37c-a954. %Feb 27 16:49:54:378 2013 HP5140-Bat-3-3 STP/6/STP_NOTIFIED_TC: Instance 0's port Bridge-Aggregation2 was notified a topology change. %Feb 27 16:49:56:798 2013 HP5140-Bat-3-3 STP/6/STP_NOTIFIED_TC: Instance 0's port Bridge-Aggregation2 was notified a topology change. %Feb 27 16:53:18:071 2013 HP5140-Bat-3-3 LLDP/6/LLDP_DELETE_NEIGHBOR: Nearest bridge agent neighbor deleted on port GigabitEthernet1/0/24 (IfIndex 24), neighbor's chassis ID is b07b-2534-668f, port ID is b07b-2534-668f. ``` I'm very New in server administration, am little bit lost ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 26, 2023, 3:29pm UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750/6 "2023-04-26T15:29:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.