When the event flow through the syslogInput, get the "_grokparsefailure_sysloginput", the priority is "0", the severity is "0", the facility is "0", like in the below:
"_source": {
"message": "<77>Jul 22 22:01:01 ip-172-31-2-48 run-parts(/etc/cron.hourly)[2599 finished 0yum-hourly.cron\n",
"@version": "1",
"@timestamp": "2015-07-22T22:01:01.569Z",
"type": "syslog",
"host": "172.31.2.48",
"tags": [
"_grokparsefailure_sysloginput"
],
"priority": 0,
"severity": 0,
"facility": 0,
"facility_label": "kernel",
"severity_label": "Emergency"
}
But the priority should be "13", the facility should be "1", the severity should be "5", based on the below source code:
###logstash-2.4.0\vendor\bundle\jruby\1.9\gems\logstash-input-syslog-2.0.5\lib\logstash\inputs\syslog.rb
if event["tags"].nil? || !event["tags"].include?(@grok_filter.tag_on_failure)
# Per RFC3164, priority = (facility * 8) + severity
# = (facility << 3) & (severity)
priority = event["priority"].to_i rescue 13
severity = priority & 7 # 7 is 111 (3 bits)
facility = priority >> 3
event["priority"] = priority
event["severity"] = severity
event["facility"] = facility
event["timestamp"] = event["timestamp8601"] if event.include?("timestamp8601")
@date_filter.filter(event)
else
@logger.info? && @logger.info("NOT SYSLOG", :message => event["message"])
# RFC3164 says unknown messages get pri=13
priority = 13
event["priority"] = 13
event["severity"] = 5 # 13 & 7 == 5
event["facility"] = 1 # 13 >> 3 == 1
end
I don't get it.
Could someone help?