# Syslog message: Tag problem and bad facility and severity values in the output of logstash

**URL:** <https://discuss.elastic.co/t/syslog-message-tag-problem-and-bad-facility-and-severity-values-in-the-output-of-logstash/33647>\
**Category:** Logstash\
**Created:** [November 3, 2015, 3:13pm UTC](https://discuss.elastic.co/t/syslog-message-tag-problem-and-bad-facility-and-severity-values-in-the-output-of-logstash/33647 "2015-11-03T15:13:45Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\
**Post date:** [November 3, 2015, 6:27pm UTC](https://discuss.elastic.co/t/syslog-message-tag-problem-and-bad-facility-and-severity-values-in-the-output-of-logstash/33647/2 "2015-11-03T18:27:03Z")

</div>

I had similar frustrations with the syslog input. I just use tcp or udp input with my own grok. Can [see here for a start](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794) but update the grok pattern accordingly.

---

_[View the full topic](https://discuss.elastic.co/t/syslog-message-tag-problem-and-bad-facility-and-severity-values-in-the-output-of-logstash/33647)._