# Syslog Severity and Priority not being parsed by syslog plugin **URL:** \ **Category:** Logstash\ **Created:** [January 25, 2016, 6:44pm UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055 "2016-01-25T18:44:29Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![avamore](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@avamore](https://discuss.elastic.co/u/avamore)\ **Post date:** [January 25, 2016, 6:44pm UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055/1 "2016-01-25T18:44:29Z")
Hi all I've upgrade to Kibana 4.3, which required Elastic 2.3 which required logstash 2.1 After I upgrade to 2.1, the syslog input is no loner parsing out priority, severity and facility properly. I receive the error: \_grokparsefailure\_sysloginput, This was working fine before I upgraded logstash.. After trying to update all plugins, at which point I ran into this [bug](https://discuss.elastic.co/t/logstash-2-1-fails-to-start-after-logstash-output-elasticsearch-update/38330/3). So now I'm just wondering if anyone has run into this issue as well and what steps they took to resolve it. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 25, 2016, 9:13pm UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055/2 "2016-01-25T21:13:51Z")
Can you give an example of a raw and unparsed syslog message? ---
**Author:** ![avamore](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@avamore](https://discuss.elastic.co/u/avamore)\ **Post date:** [January 25, 2016, 9:29pm UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055/3 "2016-01-25T21:29:17Z")
I added the raw field based on this [article](https://github.com/elastic/logstash/issues/2506) and got the following result: \<134\> Jan 25 16:21:25 JCAFARELLI-AIO BPEL: checkoutAPI: InsertMerchantInGateway: Creating Contact In Gateway I've resorted to destroying all of my templates because of said [bug report](https://www.elastic.co/guide/en/logstash/current/_upgrading_logstash_and_elasticsearch_to_2_0.html) I've also deleted all of my indexes due to the breaking 2.0 change after I was unable to update the mappings. I am now using the following filter to parse the messages: grok { match =\> { "message" =\> "\<%{POSINT:syslog\_pri}\> %{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } } } While I am now getting basic syslog message working, I am still working on deriving the severity syslog priority. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 26, 2016, 7:00am UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055/4 "2016-01-26T07:00:28Z")
> While I am now getting basic syslog message working, I am still working on deriving the severity syslog priority. Use the [syslog\_pri filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-syslog_pri.html). ---
**Author:** ![avamore](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@avamore](https://discuss.elastic.co/u/avamore)\ **Post date:** [January 26, 2016, 1:49pm UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055/5 "2016-01-26T13:49:57Z")
Yep! that is what I did! It looks better now. A lot of work for an upgrade. But the format feature is nice. If anyone one runs into this issue like I did, I used the following config: input { tcp { port =\> 514 type =\> syslog } udp { port =\> 514 type =\> syslog } } filter { if [type] == "syslog" { grok { match =\> { "message" =\> "\<%{POSINT:syslog\_pri}\> (%{SYSLOGTIMESTAMP:syslog\_timestamp}) %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } } translate { dictionary\_path =\> ["/etc/logstash/dictionary.yaml"] field =\> "syslog\_pri" destination =\> "Severity" } } } output { elasticsearch { hosts =\> localhost template\_overwrite =\> true } stdout { codec =\> rubydebug } } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055/6 "2017-07-06T05:14:18Z")