# Syslog input configuration for Logstash **URL:** \ **Category:** Logstash\ **Created:** [December 11, 2019, 5:51pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510 "2019-12-11T17:51:47Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [December 11, 2019, 5:51pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/1 "2019-12-11T17:51:47Z")
I want to send syslog files to my logstash, but not sure how to incorporate it with my beats input. When I have tried adding my beats stop working. Below is my logstash file. ``` input { beats { port => 5044 } } filter { if [source][ip] =~ /^10.3./ { mutate { replace => { "[source][geo][timezone]" => "Eastern/New York" } } mutate { replace => { "[source][geo][country_name]" => " Office" } } mutate { replace => { "[source][geo][country_code2]" => "US" } } mutate { replace => { "[source][geo][country_code3]" => "IMO" } } mutate { replace => { "[source][geo][city_name]" => "XXX" } } mutate { replace => { "[source][geo][region_name]" => "XX" } } mutate { replace => { "[source][geo][region_code]" => "XX" } } mutate { replace => { "[source][geo][postal_code]" => "XXXXX" } } mutate { update => { "[source][geo][ip]" => "[source][ip]" } } mutate { remove_field => ["[source][geo][location]" ] } mutate { add_field => { "[source][geo][location]" => "-XX.XX" } } mutate { add_field => { "[source][geo][location]" => "XX.XXX" } } mutate { convert => ["[source][geo][location]", "float" ] } mutate { replace => ["[source][geo][latitude]", XX.XX ] } mutate { convert => ["[source][geo][latitude]", "float" ] } mutate { replace => ["[source][geo][longitude]", -XX.XXX ] } mutate { convert => ["[source][geo][longitude]", "float" ] } } else { geoip { source => "[source][ip]" target=>"[source][geo]" } } } output { if [@metadata][pipeline] { elasticsearch { ilm_enabled => true hosts => ["http://10.3.200.45:9200", "http://10.3.200.46:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}" ilm_pattern => "000001" pipeline => "%{[@metadata][pipeline]}" } } else { elasticsearch { hosts => ["http://10.3.200.45:9200", "http://10.3.200.46:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}" ilm_pattern => "000001" } } } ``` ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [December 11, 2019, 5:57pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/2 "2019-12-11T17:57:23Z")
I have tried adding this tot he Input: ``` tcp { port => 5040 type => syslog } ``` This to the filter. ``` if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } ``` This to the output. ``` elasticsearch { ilm_enabled => true hosts => ["http://10.3.200.45:9200", "http://10.3.200.46:9200"] index => "syslog-000001" ilm_pattern => "000001" } } ``` Any help will be appreciated. ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [December 12, 2019, 1:54pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/3 "2019-12-12T13:54:27Z")
Anyone have any thoughts? ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [December 13, 2019, 9:05pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/4 "2019-12-13T21:05:40Z")
I am running Logstash 7.3 if that will help. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 14, 2019, 2:48pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/5 "2019-12-14T14:48:24Z")
> [@Marcell0e](#): > > When I have tried adding my beats stop working. What is your question? ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [December 16, 2019, 3:02pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/6 "2019-12-16T15:02:07Z")
I want to know how to get my beats to still work and add the syslog portion. I'm having trouble with the input and output. I have tried the input as so. ``` input { beats { port => 5044 } syslog { port => 5040 codec => cef syslog_field => "syslog" grok_pattern => "<%{POSINT:priority}>%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } } ``` I really struggle with the output. I want an if/ else statement but not sure how to structure it correctly. This is what I have so far. ``` output { if [type] == "beats" { elasticsearch { ilm_enabled => true hosts => ["http://10.3.200.45:9200", "http://10.3.200.46:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}" ilm_pattern => "000001" pipeline => "%{[@metadata][pipeline]}" } } else { elasticsearch { ilm_enabled => true hosts => ["http://10.3.200.45:9200", "http://10.3.200.46:9200"] index => "syslog-000001" ilm_pattern => "000001" } } } ``` The problem this is the beats stop working and everything goes to the syslog, but no actual syslogs are getting pulled. ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [December 18, 2019, 3:09pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/7 "2019-12-18T15:09:09Z")
Can anyone help me understand what I am doing wrong? ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [January 6, 2020, 3:37pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/8 "2020-01-06T15:37:43Z")
Does anyone have any ideas? Please and thank you. ---
**Author:** ![sampas](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@sampas](https://discuss.elastic.co/u/sampas)\ **Post date:** [January 7, 2020, 7:58pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/9 "2020-01-07T19:58:50Z")
My two cents: I tried using syslog input on Logstash many versions ago. Logstash's syslog input didn't scale, so for syslog input, I use syslog-ng which is relatively simple and scales a lot better than logstash in terms of events per second. Syslog-ng drops to a flat file. A separate logstash pipeline reads the flat file. Thus, my suggestion: 1. simple syslog-ng setup to drop to flat files. (It can even drop to a json file.) 2. pipelines.yml to separate beats input and flat file input in logstash processes. One of the benefits is that you can see the data that you'll need to parse in flat file. There are plenty of log types that send "type" as a field that will mess with your if [type] logic. ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [January 7, 2020, 8:33pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/10 "2020-01-07T20:33:42Z")
@sampas Let me see if I understand. Set up a Syslog application to gather all the logs. Then have Filebeat of something ingest them into Logstash? Does Syslog-ng work on Windows? Thank you ---
**Author:** ![sampas](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@sampas](https://discuss.elastic.co/u/sampas)\ **Post date:** [January 8, 2020, 2:46pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/11 "2020-01-08T14:46:23Z")
Syslog-ng is very good at collecting traditional events sent via the syslog protocol, but there's no windows version. I consume the flat files that syslog-ng writes with logstash, and it scales well. You could also consume the flat files with beats. Part of the value of flat files is you get to see what you're trying to parse, e.g. what format the timestamps are in, field layout, etc. Running the two listeners in separate logstash pipelines (controlled via pipeline.yml) will also help keep the logic separate. You can also have logstash output the syslog to a flat file just so you can see it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 5, 2020, 2:46pm UTC](https://discuss.elastic.co/t/syslog-input-configuration-for-logstash/211510/12 "2020-02-05T14:46:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.