# Recieves Syslogdata, but not visibel in Kibana

**URL:** <https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420>\
**Category:** Logstash\
**Created:** [March 5, 2017, 4:21pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420 "2017-03-05T16:21:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![perch](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@perch](https://discuss.elastic.co/u/perch)\
**Post date:** [March 5, 2017, 4:21pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420/1 "2017-03-05T16:21:06Z")

</div>

Setting up an ELK Stack solution. The thing I am trying to do is to get Syslog data into Logstash (maybe this is more of a Kibana issue?). The Elk stack works fine with Netflow, getting 41 fields of data to play around with. Wanted some more so I configured the Syslog plugin and I see it receiving syslog messages, ton of them! But I cant see them when Browing Kibana. My logstash.conf looks like:

```
    input { stdin { } }

```

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}

input {  
syslog {  
host =\> "192.168.200.129"  
port =\> 514  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
}

The Syslog messages looks like this, just an example:

```
{
      "severity" => 4,
    "@timestamp" => 2017-03-06T00:07:06.000Z,
      "@version" => "1",
          "host" => "192.168.200.1",
       "program" => "kernel",
       "message" => "[55560.308685] [WAN-TO-VLAN200-1-A] IN=eth1.200 OUT=eth0 MAC=00:15:5d:0a:8d:4f:00:15:5d:0a:8d:55:08:00 SRC=192.168.200.129 DST=172.xxx.22.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=91 DF PROTO=TCP SPT=59024 DPT=443 WINDOW=1019 RES=0x00 ACK FIN URGP=0 ",
      "priority" => 4,
     "logsource" => "asa01",
      "facility" => 0,
"severity_label" => "Warning",
     "timestamp" => "Mar 5 16:07:06",
"facility_label" => "kernel"

```

}

The Index pattern is logstash-\*, and I am only seeing Time fields name from when I ran Netflow. But there are some new when added the Syslog plugin.

Im very new to this, Im sure its a layer 8 problem. 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 5, 2017, 7:14pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420/2 "2017-03-05T19:14:11Z")

</div>

What does `_cat/indices` show?

---

<div class="post-metadata">

**Author:** ![perch](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@perch](https://discuss.elastic.co/u/perch)\
**Post date:** [March 5, 2017, 11:04pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420/3 "2017-03-05T23:04:36Z")

</div>

I guess I should type that in the Discover searchbox?  
If I do that I am getting: Discover: Failed to parse query [\_cat/indices]

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 5, 2017, 11:40pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420/4 "2017-03-05T23:40:06Z")

</div>

Put that into the Dev Tools section 🙂

---

<div class="post-metadata">

**Author:** ![perch](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@perch](https://discuss.elastic.co/u/perch)\
**Post date:** [March 6, 2017, 3:35pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420/5 "2017-03-06T15:35:14Z")

</div>

> [@warkolm](#):
>
> \_cat/indices

Ah, sorry. Just been at this for a very very short while and dont grasp everything yet.

I guess its its in the console i should paste the \_cat/indices command? When I copy and paste it and press the Green arrow, nothing happens.

But after a reboot of everything, it seems to be able to see the Fields. Very weird. I restarted Logstash, but not the other..

Next problem. I guess I need to make a filter to be able to use the data that is in the Message field. Can you point me to the right direction how I make that?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2017, 3:35pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420/6 "2017-04-03T15:35:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.