# Rsyslogd - Filebeat - Logstash =\> bad severity/priority

**URL:** <https://discuss.elastic.co/t/rsyslogd-filebeat-logstash-bad-severity-priority/63303>\
**Category:** Logstash\
**Created:** [October 18, 2016, 2:17pm UTC](https://discuss.elastic.co/t/rsyslogd-filebeat-logstash-bad-severity-priority/63303 "2016-10-18T14:17:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![smutel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smutel/32/75550_2.png) [@smutel](https://discuss.elastic.co/u/smutel)\
**Post date:** [October 18, 2016, 2:17pm UTC](https://discuss.elastic.co/t/rsyslogd-filebeat-logstash-bad-severity-priority/63303/1 "2016-10-18T14:17:39Z")

</div>

Hello,

I think that this question has been already asked a lot but i didn't find any answer ...

Severity of all my syslog logs is notice and priority of all my syslog logs is user-level.

I tried to change the rsyslog template with:

> $template CustomTemplate,"%TIMESTAMP% \<%syslogfacility-text%:%syslogfacility%\> \<%syslogseverity-text%:%syslogseverity%\> %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf% (%pri-text%)\n"  
> $ActionFileDefaultTemplate CustomTemplate

And to change the grok part in logstash but it does not work ...

> if [type] == "syslog" {  
> grok {  
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} \<%{WORD:syslog\_facility}:%{POSINT:syslog\_facility\_code}\> \<%{WORD:syslog\_severity}:%{POSINT:syslog\_severity\_code}\> %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
> add\_field =\> ["received\_at", "%{@timestamp}"]  
> add\_field =\> ["received\_from", "%{host}"]  
> }  
> syslog\_pri { }  
> date {  
> match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
> }  
> }

---

<div class="post-metadata">

**Author:** ![smutel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smutel/32/75550_2.png) [@smutel](https://discuss.elastic.co/u/smutel)\
**Post date:** [October 19, 2016, 7:08am UTC](https://discuss.elastic.co/t/rsyslogd-filebeat-logstash-bad-severity-priority/63303/2 "2016-10-19T07:08:21Z")

</div>

I found the solution myself so I share with everybody.

_Template to use with rsyslog:_

> $template CustomTemplate,"\<%PRI%\>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"  
> $ActionFileDefaultTemplate CustomTemplate

_Logstash config:_

> grok {  
> match =\> { "message" =\> "\<%{DATA:syslog\_pri}\>%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
> add\_field =\> ["received\_at", "%{@timestamp}"]  
> add\_field =\> ["received\_from", "%{host}"]  
> }  
> syslog\_pri { }  
> date {  
> match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
> }  
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/rsyslogd-filebeat-logstash-bad-severity-priority/63303/3 "2017-07-06T04:33:36Z")

</div>