# Syslog filebeat input, how to get sender IP address?

**URL:** https://discuss.elastic.co/t/syslog-filebeat-input-how-to-get-sender-ip-address/214809
**Category:** Beats
**Tags:** filebeat
**Created:** [January 13, 2020, 11:12am UTC](https://discuss.elastic.co/t/syslog-filebeat-input-how-to-get-sender-ip-address/214809 "2020-01-13T11:12:33Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![emilie](https://avatars.discourse-cdn.com/v4/letter/e/aeb1de/32.png) [@emilie](https://discuss.elastic.co/u/emilie)
#### Post date: [January 15, 2020, 4:07pm UTC](https://discuss.elastic.co/t/syslog-filebeat-input-how-to-get-sender-ip-address/214809/6 "2020-01-15T16:07:13Z")

</div>

If I understand it right, reading [this spec of CEF](https://kc.mcafee.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/78000/KB78712/en_US/CEF_White_Paper_20100722.pdf), which makes reference to [SimpleDateFormat](https://docs.oracle.com/javase/7/docs/api/java/text/SimpleDateFormat.html#timezone)

```
    CEF supports several variations on time/date formats to identify the time an event occurred accurately. These formats are detailed below. 

    1.Milliseconds since January 1, 1970 (integer)
    —This time format supplies an integer with the count in milliseconds from January 1, 1970 to the time the event occurred. 
    2.MMM dd HH:mm:ss  
    3.MMM dd HH:mm:ss.SSS zzz  
    4.MMM dd HH:mm:ss.SSS  
    5.MMM dd HH:mm:ss zzz  
    6.MMM dd yyyy HH:mm:ss  
    7.MMM dd yyyy HH:mm:ss.SSS zzz  
    8.MMM dd yyyy HH:mm:ss.SSS  
    9.MMM dd yyyy HH:mm:ss zzz 

For a key to the date formats shown above, visit the SimpleDateFormat page at: java.sun.com/j2se/1.4.2/docs/api/java/text/SimpleDateFormat.html.

```

which seems to be handled [there in beats](https://github.com/elastic/beats/blob/a77de0d3e2a095ffa325d8aeb9193d5b96f11d1d/x-pack/filebeat/processors/decode_cef/cef/types.go#L103)

there should be more format strings in timeLayouts.  
In my case "Jan 2 2006 15:04:05 GMT-07:00" is missing, RFC 822 time zone is also missing

If I'm not wrong, General time zone can be specified as `Pacific Standard Time` or `GMT-08:00` not only the `PST` string (like it is handled in beats).

---

_[View the full topic](https://discuss.elastic.co/t/syslog-filebeat-input-how-to-get-sender-ip-address/214809)._