# Syslog stream
**URL:** https://discuss.elastic.co/t/syslog-stream/131425
**Category:** Logstash
**Created:** [May 11, 2018, 7:42am UTC](https://discuss.elastic.co/t/syslog-stream/131425 "2018-05-11T07:42:52Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@asalma](https://discuss.elastic.co/u/asalma)
#### Post date: [May 11, 2018, 7:42am UTC](https://discuss.elastic.co/t/syslog-stream/131425/1 "2018-05-11T07:42:52Z")
Hi,
I want to know, please, how can I configure Logstash to retrieve a syslog stream directly.
---
### Author:  [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [May 11, 2018, 9:09am UTC](https://discuss.elastic.co/t/syslog-stream/131425/2 "2018-05-11T09:09:06Z")
Hi,
Sorry, if my English is bad, I do not speak English normally.
Here is an example of a configuration file for log collection:
input {
udp {
port =\> 514 (default)
type =\> syslog
}
}
filter {
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
---
### Author:  [@asalma](https://discuss.elastic.co/u/asalma)
#### Post date: [May 11, 2018, 9:25am UTC](https://discuss.elastic.co/t/syslog-stream/131425/3 "2018-05-11T09:25:12Z")
Can I write my conf file like this ? ( Je peux écrire mon fichier de configuration comme ça ? parce que le syslog va m'envoyer des logs du parfeu cisco asa )
input {
```
udp {
port => 514
type => syslog
}
```
}
filter {
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
```
grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:hostname} %{DATA:cisco_tag}: %{GREEDYDATA:cisco_message}"}
}
grok {
match => [
"cisco_message", "%{CISCOFW106001}",
"cisco_message", "%{CISCOFW106006_106007_106010}",
"cisco_message", "%{CISCOFW106014}",
"cisco_message", "%{CISCOFW106015}",
"cisco_message", "%{CISCOFW106021}",
"cisco_message", "%{CISCOFW106023}",
"cisco_message", "%{CISCOFW106100}",
"cisco_message", "%{CISCOFW110002}",
"cisco_message", "%{CISCOFW302010}",
"cisco_message", "%{CISCOFW302013_302014_302015_302016}",
"cisco_message", "%{CISCOFW302020_302021}",
"cisco_message", "%{CISCOFW305011}",
"cisco_message", "%{CISCOFW313001_313004_313008}",
"cisco_message", "%{CISCOFW313005}",
"cisco_message", "%{CISCOFW402117}",
"cisco_message", "%{CISCOFW402119}",
"cisco_message", "%{CISCOFW419001}",
"cisco_message", "%{CISCOFW419002}",
"cisco_message", "%{CISCOFW500004}",
"cisco_message", "%{CISCOFW602303_602304}",
"cisco_message", "%{CISCOFW710001_710002_710003_710005_710006}",
```
"cisco\_message", "%{CISCOFW713172}",
"cisco\_message", "%{CISCOFW733100}",
"cisco\_message", "%{WORD:action} %{WORD:protocol} %{CISCO\_REASON:reason} from %{DATA:src\_interface}:%{IP:src\_ip}/%{INT:src\_port} to %{DATA:dst\_interface}:%{IP:dst\_ip}$
"cisco\_message", "%{CISCO\_ACTION:action} %{WORD:protocol} %{CISCO\_REASON:reason}._(%{IP:src\_ip})._%{IP:dst\_ip} on interface %{GREEDYDATA:interface}",
"cisco\_message", "Connection limit exceeded %{INT:inuse\_connections}/%{INT:connection\_limit} for input packet from %{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:$
"cisco\_message", "TCP Intercept %{DATA:threat\_detection} to %{IP:ext\_nat\_ip}/%{INT:ext\_nat\_port}.\*(%{IP:int\_nat\_ip}/%{INT:int\_nat\_port}).\*Average rate of %{INT:syn\_av$
"cisco\_message", "Embryonic connection limit exceeded %{INT:econns}/%{INT:limit} for %{WORD:direction} packet from %{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:$
]
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
}
stdout { codec =\> rubydebug }
}
---
### Author:  [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)
#### Post date: [May 11, 2018, 11:11am UTC](https://discuss.elastic.co/t/syslog-stream/131425/4 "2018-05-11T11:11:02Z")
@asalma
The endpoint device being an ASA is of no issue, as long as its in syslog you can grok the fields you want to put into Elasticsearch.
Your English is good enough for all to understand your ask.
Please note, if you are more comfortable in French over English we also have this section of our discuss forums: [https://discuss.elastic.co/c/in-your-native-tongue](https://discuss.elastic.co/c/in-your-native-tongue)
---
### Author:  [@asalma](https://discuss.elastic.co/u/asalma)
#### Post date: [May 11, 2018, 12:20pm UTC](https://discuss.elastic.co/t/syslog-stream/131425/5 "2018-05-11T12:20:45Z")
Can you help me modify my file, what should I change ??
---
### Author:  [@asalma](https://discuss.elastic.co/u/asalma)
#### Post date: [May 11, 2018, 12:29pm UTC](https://discuss.elastic.co/t/syslog-stream/131425/6 "2018-05-11T12:29:58Z")
My problem is that I have firewall logs in syslog and I want to redirect them directly to logstash so they go through the filter and be able to see them in kibana.
How can I write my config file ?
---
### Author:  [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)
#### Post date: [May 11, 2018, 12:33pm UTC](https://discuss.elastic.co/t/syslog-stream/131425/7 "2018-05-11T12:33:10Z")
Est ce que t'arrive à voir tes logs en fouilant sur les fichier systeme (exemple : /var/log/etc ) ?
---
### Author:  [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)
#### Post date: [May 11, 2018, 12:51pm UTC](https://discuss.elastic.co/t/syslog-stream/131425/8 "2018-05-11T12:51:00Z")
See the syslog examples here:
> [@Cisco Log Processing](https://discuss.elastic.co/t/cisco-log-processing/79870/2):
>
> Logstash ships with a bunch of grok patterns for various kind of Cisco logs:
> **[How To Centralize Logs with Rsyslog, Logstash, and Elasticsearch on Ubuntu 14.04](https://www.elastic.co/blog/how-to-centralize-logs-with-rsyslog-logstash-and-elasticsearch-on-ubuntu-14-04)**
>
> In this tutorial, you will learn how to create a centralized rsyslog server to store log files from multiple systems and then use Logstash to send them to an Elasticsearch server. From there, you can decide how best to analyze the data.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 8, 2018, 1:03pm UTC](https://discuss.elastic.co/t/syslog-stream/131425/9 "2018-06-08T13:03:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.