# Syslog\_severity\_code it's always "5" , syslog\_facility it's always "1", syslog\_facility it's always "user-level" and syslog\_severity it's always "notice"

**URL:** <https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892>\
**Category:** Logstash\
**Created:** [June 9, 2017, 8:38pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892 "2017-06-09T20:38:55Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Julian\_Tete](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Julian\_Tete](https://discuss.elastic.co/u/Julian_Tete)\
**Post date:** [June 9, 2017, 8:38pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/1 "2017-06-09T20:38:56Z")

</div>

Hello ELK's Friends

I am trying to set up an ELK system to replace an Rsyslog + Adiscon LogAnalyzer implementation. The operating system used was CentOS 7.3 The versions of the installed packages were the following:

filebeat.x86\_64 0:5.4.1-1

kibana.x86\_64 0:5.4.1-1

logstash.noarch 1:5.4.1-1

elasticsearch.noarch 0:5.4.1-1

The Logstash configuration files are as follows:

/etc/logstash/conf.d/input.conf

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

/etc/logstash/conf.d/output.conf

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

/etc/logstash/conf.d/filter.conf

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

In the client operating system (CentOS 7.3)

FileBeat was configured as follows:

(No comment)

/etc/filebeat/filebeat.yml

filebeat:  
prospectors:  
-  
paths:  
- /var/log/\*.log  
- /var/log/secure  
- /var/log/dmesg  
- /var/log/messages  
input\_type: log  
document\_type: syslog  
registry\_file: /var/lib/filebeat/registry  
output:  
elasticsearch:  
hosts: ["localhost:9200"]  
logstash:  
hosts: ["[elk.example.com:5044](http://elk.example.com:5044)"]  
tls:  
certificate\_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]  
shipper:  
logging:  
files:

But in Kibana, all events are classified as well

syslog\_severity\_code 5 or -

syslog\_facility user-level or -

Any help will be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [June 10, 2017, 1:27am UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/2 "2017-06-10T01:27:56Z")

</div>

Hi  
Can you make paths: section entry one line like

paths:  
- /var/log/messages

Also comment/remove the following logstash hosts section.

logstash:  
hosts: ["[elk.example.com:5044](http://elk.example.com:5044)"]

Restart the logstash and run the following in the terminal -

$ tail -f /var/log/messages

Now check whether all the logs that have been shown by above command are transferred to kibana dashboard.

Regards

---

<div class="post-metadata">

**Author:** ![Julian\_Tete](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Julian\_Tete](https://discuss.elastic.co/u/Julian_Tete)\
**Post date:** [June 12, 2017, 4:24pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/3 "2017-06-12T16:24:53Z")

</div>

Hi Makra

But if I remove the hosts section, How can I found the S.O Server, from the S.O Client ?

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [June 13, 2017, 12:20am UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/4 "2017-06-13T00:20:46Z")

</div>

Hi  
Julian  
I assume your logstash host is remote one where you are sending the logs directly (port 5044) and ES is localhost. Now, Do you want the logs to be transferred to ES and logstash host simultaneously ?  
It looks to me your configuration is correct. What is the result of tail command ? Does the same logs appear in the Kibana ? If that is the case then you need check the syslog configuration.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 13, 2017, 8:36am UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/5 "2017-06-13T08:36:48Z")

</div>

The syslog\_pri filter reads a field with the encoded facility and severity information. By default it reads the `syslog_pri` field. Do you have a `syslog_pri` field?

---

<div class="post-metadata">

**Author:** ![Julian\_Tete](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Julian\_Tete](https://discuss.elastic.co/u/Julian_Tete)\
**Post date:** [June 13, 2017, 4:04pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/6 "2017-06-13T16:04:37Z")

</div>

Yeah that's the idea Makra simultaneously. Tail a which archive Makra ?

---

<div class="post-metadata">

**Author:** ![Julian\_Tete](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Julian\_Tete](https://discuss.elastic.co/u/Julian_Tete)\
**Post date:** [June 13, 2017, 4:05pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/7 "2017-06-13T16:05:39Z")

</div>

Hi magnusbaeck

Please look at this:

/etc/logstash/conf.d/filter.conf

filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [June 13, 2017, 4:18pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/8 "2017-06-13T16:18:58Z")

</div>

Add log files one by one. Lets tail syslog first and check that the logs do arrive in the kibana. If you have something wrong in logstash filter configuration then there will be some events that you can see in the output of tail command but will not be there in kibana. This will make sure that the logstash configuration is correct.

Make filebeat paths: section points to /var/log/syslog

paths:  
- /var/log/messages  
.................................................

Check the syslog that arrives in the files.

$ tail -f /var/log/syslog

Hope this helps

---

<div class="post-metadata">

**Author:** ![Julian\_Tete](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Julian\_Tete](https://discuss.elastic.co/u/Julian_Tete)\
**Post date:** [June 13, 2017, 4:46pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/9 "2017-06-13T16:46:45Z")

</div>

Mmmm my setup is like this [elkserver.example.com](http://elkserver.example.com) (That server hosts Elesticsearch, Logstash and Kibana) and elkclient (Only has filebeat)

In [elkclient.example.com](http://elkclient.example.com) with only /var/log/messages path

tail -f /var/log/messages

Jun 13 11:31:25 elkclient systemd: Time has been changed  
Jun 13 11:31:25 elkclient chronyd[813]: System clock was stepped by 14401.230573 seconds  
Jun 13 11:31:32 elkclient systemd: Created slice user-1000.slice.  
Jun 13 11:31:32 elkclient systemd: Starting user-1000.slice.  
Jun 13 11:31:32 elkclient systemd: Started Session 2 of user cnscadmin.  
Jun 13 11:31:32 elkclient systemd-logind: New session 2 of user cnscadmin.  
Jun 13 11:31:32 elkclient systemd: Starting Session 2 of user cnscadmin.  
Jun 13 11:31:33 elkclient bash[1300]: cnscadmin [192.168.7.126] : #011 su -  
Jun 13 11:31:37 elkclient su: (to root) cnscadmin on pts/0  
Jun 13 11:31:38 elkclient bash[1359]: root [] : #011 systemctl reboot

In [elkserver.example.com](http://elkserver.example.com)

curl -XGET '[http://localhost:9200/filebeat-\*/\_search?pretty](http://localhost:9200/filebeat-*/_search?pretty)':

{  
"took" : 3,  
"timed\_out" : false,  
"\_shards" : {  
"total" : 50,  
"successful" : 50,  
"failed" : 0  
},  
"hits" : {  
"total" : 42218,  
"max\_score" : 1.0,  
"hits" : [  
{  
"\_index" : "filebeat-2017.05.25",  
"\_type" : "log",  
"\_id" : "AVxBPPh4yM45-hZBb-Ff",  
"\_score" : 1.0,  
"\_source" : {  
"@timestamp" : "2017-05-25T20:12:08.669Z",  
"beat" : {  
"hostname" : "[elk.example.com](http://elk.example.com)",  
"name" : "[elk.example.com](http://elk.example.com)",  
"version" : "5.4.0"  
},  
"input\_type" : "log",  
"message" : "Aug 01 10:40:01 Updated: systemd-libs-219-19.el7\_2.11.x86\_64",  
"offset" : 300,  
"source" : "/var/log/yum.log",  
"type" : "log"  
}  
},  
{  
"\_index" : "filebeat-2017.05.25",  
"\_type" : "log",  
"\_id" : "AVxBPPh4yM45-hZBb-Fh",  
"\_score" : 1.0,  
"\_source" : {  
"@timestamp" : "2017-05-25T20:12:08.669Z",  
"beat" : {  
"hostname" : "[elk.example.com](http://elk.example.com)",  
"name" : "[elk.example.com](http://elk.example.com)",  
"version" : "5.4.0"  
},  
"input\_type" : "log",  
"message" : "Aug 01 10:40:01 Updated: nss-util-3.21.0-2.2.el7\_2.x86\_64",  
"offset" : 410,  
"source" : "/var/log/yum.log",  
"type" : "log"  
}  
},  
{  
"\_index" : "filebeat-2017.05.25",  
"\_type" : "log",  
"\_id" : "AVxBPPh4yM45-hZBb-Fj",  
"\_score" : 1.0,  
"\_source" : {  
"@timestamp" : "2017-05-25T20:12:08.669Z",  
"beat" : {  
"hostname" : "[elk.example.com](http://elk.example.com)",  
"name" : "[elk.example.com](http://elk.example.com)",  
"version" : "5.4.0"  
},  
"input\_type" : "log",  
"message" : "Aug 01 10:40:01 Updated: libgudev1-219-19.el7\_2.11.x86\_64",  
"offset" : 526,  
"source" : "/var/log/yum.log",  
"type" : "log"  
}  
},  
{  
"\_index" : "filebeat-2017.05.25",  
"\_type" : "log",  
"\_id" : "AVxBPPh4yM45-hZBb-Fk",  
"\_score" : 1.0,  
"\_source" : {  
"@timestamp" : "2017-05-25T20:12:08.669Z",  
"beat" : {  
"hostname" : "[elk.example.com](http://elk.example.com)",  
"name" : "[elk.example.com](http://elk.example.com)",  
"version" : "5.4.0"  
},  
"input\_type" : "log",  
"message" : "[\u001B[32m OK \u001B[0m] Started Show Plymouth Boot Screen.",  
"offset" : 54,  
"source" : "/var/log/boot.log",  
"type" : "log"  
}  
},  
{  
"\_index" : "filebeat-2017.05.25",  
"\_type" : "log",  
"\_id" : "AVxBPPh4yM45-hZBb-Fm",  
"\_score" : 1.0,  
"\_source" : {  
"@timestamp" : "2017-05-25T20:12:08.669Z",  
"beat" : {  
"hostname" : "[elk.example.com](http://elk.example.com)",  
"name" : "[elk.example.com](http://elk.example.com)",  
"version" : "5.4.0"  
},  
"input\_type" : "log",  
"message" : "Aug 01 10:40:02 Updated: libxml2-2.9.1-6.el7\_2.3.x86\_64",  
"offset" : 640,  
"source" : "/var/log/yum.log",  
"type" : "log"  
}  
},  
{  
"\_index" : "filebeat-2017.05.25",  
"\_type" : "log",  
"\_id" : "AVxBPPh4yM45-hZBb-Fv",  
"\_score" : 1.0,  
"\_source" : {  
"@timestamp" : "2017-05-25T20:12:08.669Z",  
"beat" : {  
"hostname" : "[elk.example.com](http://elk.example.com)",  
"name" : "[elk.example.com](http://elk.example.com)",  
"version" : "5.4.0"  
},  
"input\_type" : "log",  
"message" : "[\u001B[32m OK \u001B[0m] Reached target Remote File Systems.",  
"offset" : 512,  
"source" : "/var/log/boot.log",  
"type" : "log"  
}  
},  
{  
"\_index" : "filebeat-2017.05.25",  
"\_type" : "log",  
"\_id" : "AVxBPPh4yM45-hZBb-F0",  
"\_score" : 1.0,  
"\_source" : {  
"@timestamp" : "2017-05-25T20:12:08.669Z",  
"beat" : {  
"hostname" : "[elk.example.com](http://elk.example.com)",  
"name" : "[elk.example.com](http://elk.example.com)",  
"version" : "5.4.0"  
},  
"input\_type" : "log",  
"message" : "Aug 01 10:40:14 Updated: pcre-8.32-15.el7\_2.1.x86\_64",  
"offset" : 814,  
"source" : "/var/log/yum.log",  
"type" : "log"  
}  
},  
}  
]  
}  
}

In Kibana:

Table:

JSON:

{  
"\_index": "filebeat-2017.06.13",  
"\_type": "syslog",  
"\_id": "AVyiSt1v\_ojTDgCejFaf",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"syslog\_pid": "1407",  
"syslog\_severity\_code": 5,  
"offset": 78,  
"syslog\_facility": "user-level",  
"count": 1,  
"input\_type": "log",  
"syslog\_facility\_code": 1,  
"source": "/var/log/messages",  
"syslog\_program": "bash",  
"message": "Jun 13 11:29:45 elkclient bash[1407]: root [] : #011 echo "" \> /var/log/messages",  
"type": "syslog",  
"syslog\_message": "root [] : #011 echo "" \> /var/log/messages",  
"syslog\_severity": "notice",  
"tags": [  
"beats\_input\_codec\_plain\_applied"  
],  
"received\_from": "[elkclient.example.com](http://elkclient.example.com)",  
"@timestamp": "2017-06-13T16:29:45.000Z",  
"syslog\_hostname": "elkclient",  
"syslog\_timestamp": "Jun 13 11:29:45",  
"received\_at": "2017-06-13T12:30:30.614Z",  
"@version": "1",  
"beat": {  
"hostname": "[elkclient.example.com](http://elkclient.example.com)",  
"name": "[elkclient.example.com](http://elkclient.example.com)"  
},  
"host": "[elkclient.example.com](http://elkclient.example.com)",  
"fields": null  
},  
"fields": {  
"@timestamp": [  
1497371385000  
]  
},  
"sort": [  
1497371385000  
]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2017, 4:46pm UTC](https://discuss.elastic.co/t/syslog-severity-code-its-always-5-syslog-facility-its-always-1-syslog-facility-its-always-user-level-and-syslog-severity-its-always-notice/88892/10 "2017-07-11T16:46:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.