# Send full syslog unparsed message
**URL:** https://discuss.elastic.co/t/send-full-syslog-unparsed-message/195468
**Category:** Beats
**Tags:** filebeat
**Created:** [August 16, 2019, 9:57am UTC](https://discuss.elastic.co/t/send-full-syslog-unparsed-message/195468 "2019-08-16T09:57:32Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@probson](https://discuss.elastic.co/u/probson)
#### Post date: [August 16, 2019, 9:57am UTC](https://discuss.elastic.co/t/send-full-syslog-unparsed-message/195468/1 "2019-08-16T09:57:32Z")
Hi,
I am using filebeat to collect syslogs from a cisco firepower IPS straight to logstash. Filebeat is able to parse the time, the issue is that firepower sends the time in RFC3164 in UTC. Filebeat is parsing the syslog timestamp but removing another hour, as such my logs are an hour behind UTC.
Is it possible to access the original unparsed message in logstash so that i can get the SYSLOGTIMESTAMP?
I have been trying to use the below in logstash to no avail.
date {
match =\> ["timestamp", "MMM dd HH:mm:ss", "ISO8601"]
timezone =\> "UTC"
}
Looking at the pipelines in filebeat for elasticsearch it looks as though it expects the full syslog message.
Any pointers?
Thanks
Phil
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 16, 2019, 12:08pm UTC](https://discuss.elastic.co/t/send-full-syslog-unparsed-message/195468/2 "2019-08-16T12:08:00Z")
If you want to do all parsing and processing, then you might want to use the tcp and/or udp inputs directly. Internally the syslog input just reuses those two inputs, but adds parsing on top.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2019, 12:10pm UTC](https://discuss.elastic.co/t/send-full-syslog-unparsed-message/195468/3 "2019-09-13T12:10:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.