# Problem with my logstash file '.conf' for analyse syslog from my switchs

**URL:** <https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750>\
**Category:** Logstash\
**Created:** [March 28, 2023, 7:10pm UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750 "2023-03-28T19:10:57Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [March 29, 2023, 10:26am UTC](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750/2 "2023-03-29T10:26:06Z")

</div>

You need .conf similar to this:

```auto
input {
 syslog {
  port => 514
 }
}
filter {
# later will add grok like SYSLOGLINE or similar parser 
}
output {

 file { path => "/path/hpsyslog_%{+YYYY-MM-dd}.txt" }
 stdout { codec => rubydebug{ } }

}

```

The message should be like this:  
`<189>Oct 9 14:59:04 2022 Sysname %%10SHELL/5/SHELL_LOGIN(l): VTY logged in from 192.168.1.1`  
Check the received messages and the documentation to get fields description. The grok conf should be like [this](https://discuss.elastic.co/t/hp-procurve-switch-log-files-not-showing/33976).

---

_[View the full topic](https://discuss.elastic.co/t/problem-with-my-logstash-file-conf-for-analyse-syslog-from-my-switchs/328750)._