# Rsyslog to logstash help

**URL:** <https://discuss.elastic.co/t/rsyslog-to-logstash-help/108254>\
**Category:** Logstash\
**Created:** [November 18, 2017, 11:22pm UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-help/108254 "2017-11-18T23:22:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\
**Post date:** [November 18, 2017, 11:22pm UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-help/108254/1 "2017-11-18T23:22:55Z")

</div>

Hello,

I am seeking advice regarding getting multiple syslog devices into logstash/elasticsearch.

I currently send syslog messages from multiple devices to a central rsyslog server on port `514`. Because the messages are coming from different devices, different vendors, the message structure is different. I currently forward all messages from rsyslog to logstash on port 10514, using the `*.*@ip-address-logstash-server;` configuration.

My question is where/how should i best filter these messages before sending them from logstash to elasticsearch.

1. Does it make sense to use conditionals in my logatash filter based off the syslog `[program]` field and add a `tag`, then use another conditional in my logstash output to create an index for each syslog type/tag?
2. Am i correct in thinking all different types of input, should have its own output index?
3. Does it make sense to somehow do some filtering on the rsyslog side, and add some kind of tagging fields there in the message before sending it to logstash?

This is my architecture currently.

![elk-rsyslog-architecture](https://us1.discourse-cdn.com/elastic/original/3X/9/2/92467eb1a41e79aa08ee5c30918e999bd2ad08fc.PNG)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 18, 2017, 11:52pm UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-help/108254/2 "2017-11-18T23:52:48Z")

</div>

1. Yes 🙂
2. Depends, how different are they?
3. It may make things easier, but if the `program` value is unique then it's probably not worth the extra work.

---

<div class="post-metadata">

**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\
**Post date:** [November 18, 2017, 11:55pm UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-help/108254/3 "2017-11-18T23:55:04Z")

</div>

Ta, can you please go a little deeper into your insight on "depends on how different they are"?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 19, 2017, 12:11am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-help/108254/4 "2017-11-19T00:11:36Z")

</div>

Data sources that are dramatically different should go into different indices.  
But say you had an application that had a few different versions deployed in your environment, and they had slightly different formats (eg additional fields in newer versions), then adding them into the same index would be ok.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2017, 12:11am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-help/108254/5 "2017-12-17T00:11:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.