# Syslog Parser error - Viavi Gigflow

**URL:** <https://discuss.elastic.co/t/syslog-parser-error-viavi-gigflow/173465>\
**Category:** Logstash\
**Created:** [March 22, 2019, 9:49am UTC](https://discuss.elastic.co/t/syslog-parser-error-viavi-gigflow/173465 "2019-03-22T09:49:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ronanohart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ronanohart/32/42574_2.png) [@ronanohart](https://discuss.elastic.co/u/ronanohart)\
**Post date:** [March 22, 2019, 9:49am UTC](https://discuss.elastic.co/t/syslog-parser-error-viavi-gigflow/173465/1 "2019-03-22T09:49:56Z")

</div>

I am trying to parse the following syslog message and keep getting a grokparsefailure

message as sent from Gigaflow  
`{"Application":"TCP/34056","Eventer":"172.0.0.1","Syn Type":"Destination","appid":427272,"bytes":152,"device":"172.0.0.1","domain":"","dstadd":"172.0.0.1","dstport":34056,"duration":1124,"eventname":"Syn Dst Port Sweep","flags":2,"fwevent":0,"fwextcode":0,"inif":14,"macdst":"00:00:00:00:00:00","macsrc":"00:00:00:00:00:00","outif":30,"packets":3,"proto":6,"srcadd":"172.0.0.1","srcport":57058,"time":1475147662254,"timeH":"29-Sep-2016 12:14:22.254","tos":0,"user":""}`

Message as seen in logstash  
`<189>{\"Application\":\"TCP/34056\",\"Eventer\":\"172.0.0.1\",\"Syn Type\":\"Destination\",\"appid\":427272,\"bytes\":152,\"device\":\"172.0.0.1\",\"domain\":\"\",\"dstadd\":\"172.0.0.1\",\"dstport\":34056,\"duration\":1124,\"eventname\":\"Syn Dst Port Sweep\",\"flags\":2,\"fwevent\":0,\"fwextcode\":0,\"inif\":14,\"macdst\":"00:00:00:00:00:00\",\"macsrc\":\"00:00:00:00:00:00\",\"outif\":30,\"packets\":3,\"proto\":6,\"srcadd\":\"172.0.0.1\",\"srcport\":57058,\"time\":1475147662254,\"timeH\":\"29-Sep-2016 12:14:22.254\",\"tos\":0,\"user\":\"\"}`

The Parser code I have appears to be failing at **"Ap**  
`match => ['message', '<%{POSINT:syslog_pri}>.*\/%{NUMBER:appport}.*Syn Type\\":\\"%{WORD:syntype}\\",\\"appid\\":%{NUMBER:appid},\\"by.*device\\":\\"%{IP:deviceip}\\",\\"dom.*dstadd\\":\\"%{IP:dstip}\\",\\"dstport\\":%{NUMBER:dstport},.*eventname\\":\\"%{GREEDYDATA:eventname}\\",\\"fl.*macdst\\":\\"%{MAC:macdst}\\",\\"macsrc\\":\\"%{MAC:macsrc}.*srcadd\\":\\"%{IP:srcip}\\",\\"srcport\\":%{NUMBER:srcport}']`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2019, 1:14pm UTC](https://discuss.elastic.co/t/syslog-parser-error-viavi-gigflow/173465/2 "2019-03-22T13:14:56Z")

</div>

Why not use a json filter?

```
    grok { match => { "message" => "^<%{NUMBER:pri:int}>" } }
    mutate { gsub => ["message", "^<[0-9]+>", "" ] }
    json { source => "message" }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2019, 1:14pm UTC](https://discuss.elastic.co/t/syslog-parser-error-viavi-gigflow/173465/3 "2019-04-19T13:14:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.