# Syslog Filter Plugin
**URL:** https://discuss.elastic.co/t/syslog-filter-plugin/254187
**Category:** Logstash
**Created:** [November 3, 2020, 9:50pm UTC](https://discuss.elastic.co/t/syslog-filter-plugin/254187 "2020-11-03T21:50:48Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Clay\_Curtis](https://discuss.elastic.co/u/Clay_Curtis)
#### Post date: [November 3, 2020, 9:50pm UTC](https://discuss.elastic.co/t/syslog-filter-plugin/254187/1 "2020-11-03T21:50:48Z")
I am building a logging pipeline and there is a syslog collector that is depositing raw syslog messages into a Kafka topic. I would usually accept syslog off the wire by using the Logstash `syslog` input plugin which handles the parsing of the syslog header very nicely. But in this instance, my input is now a Kafka topic, and therefore I am finding it difficult to process the events as syslog messages as the `syslog` input plugin only accepts events from a network port. Is there such a thing as a `syslog` filter plugin, or codec?
Example raw syslog message as stored in Kafka.
```auto
<14>Nov 3 16:42:05 CX-PaloHE01.acme.com 1,2020/11/03 16:42:04,013222003452,TRAFFIC,end,2304,2020/11/03 16:42:04,10.170.3.113,217.58.197.68,8.37.68.200,217.58.197.68,GlobalProtect-Internet-Access,prod\tomar,,quic,vsys2,Prod-GlobalProtect,Prod-L3-inet,tunnel.9998,ethernet1/8.666,SIEM-Syslog,2020/11/03 16:42:04,2593114,1,65111,443,31573,443,0x400050,udp,allow,2863,1467,1396,3,2020/11/03 16:40:02,0,any,0,6854539165046534753,0x0,10.0.0.0-10.255.255.255,United States,0,2,1,aged-out,171,0,0,0,Production,CX-PaloHE01,from-policy,,,0,,0,,N/A,0,0,0,0,bfc04636-c4f2-43ef-a25d-9f93fe9a04b3,0
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 4, 2020, 4:53pm UTC](https://discuss.elastic.co/t/syslog-filter-plugin/254187/2 "2020-11-04T16:53:27Z")
A syslog input applies a grok pattern
```
"<%{POSINT:priority}>%{SYSLOGLINE}"
```
You can then use a syslog\_pri filter to parse the priority field.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 2, 2020, 4:53pm UTC](https://discuss.elastic.co/t/syslog-filter-plugin/254187/3 "2020-12-02T16:53:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.