# The output don't match the source code IN SYSLOG INPUT plugin

**URL:** <https://discuss.elastic.co/t/the-output-dont-match-the-source-code-in-syslog-input-plugin/62593>\
**Category:** Logstash\
**Created:** [October 10, 2016, 4:23am UTC](https://discuss.elastic.co/t/the-output-dont-match-the-source-code-in-syslog-input-plugin/62593 "2016-10-10T04:23:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![xiaozhuqq48](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\
**Post date:** [October 10, 2016, 4:23am UTC](https://discuss.elastic.co/t/the-output-dont-match-the-source-code-in-syslog-input-plugin/62593/1 "2016-10-10T04:23:53Z")

</div>

When the event flow through the syslogInput, get the "\_grokparsefailure\_sysloginput", the priority is "0", the severity is "0", the facility is "0", like in the below:

"\_source": {  
"message": "\<77\>Jul 22 22:01:01 ip-172-31-2-48 run-parts(/etc/cron.hourly)[2599 finished 0yum-hourly.cron\n",  
"@version": "1",  
"@timestamp": "2015-07-22T22:01:01.569Z",  
"type": "syslog",  
"host": "172.31.2.48",  
"tags": [  
"\_grokparsefailure\_sysloginput"  
],  
"priority": 0,  
"severity": 0,  
"facility": 0,  
"facility\_label": "kernel",  
"severity\_label": "Emergency"  
}

But the priority should be "13", the facility should be "1", the severity should be "5", based on the below source code:

###logstash-2.4.0\vendor\bundle\jruby\1.9\gems\logstash-input-syslog-2.0.5\lib\logstash\inputs\syslog.rb  
if event["tags"].nil? || !event["tags"].include?(@grok\_filter.tag\_on\_failure)  
# Per RFC3164, priority = (facility \* 8) + severity  
# = (facility \<\< 3) & (severity)  
priority = event["priority"].to\_i rescue 13  
severity = priority & 7 # 7 is 111 (3 bits)  
facility = priority \>\> 3  
event["priority"] = priority  
event["severity"] = severity  
event["facility"] = facility  
event["timestamp"] = event["timestamp8601"] if event.include?("timestamp8601")  
@date\_filter.filter(event)  
else  
@logger.info? && @logger.info("NOT SYSLOG", :message =\> event["message"])  
# RFC3164 says unknown messages get pri=13  
priority = 13  
event["priority"] = 13  
event["severity"] = 5 # 13 & 7 == 5  
event["facility"] = 1 # 13 \>\> 3 == 1  
end

I don't get it.  
Could someone help?

---

<div class="post-metadata">

**Author:** ![xiaozhuqq48](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\
**Post date:** [October 10, 2016, 6:19am UTC](https://discuss.elastic.co/t/the-output-dont-match-the-source-code-in-syslog-input-plugin/62593/2 "2016-10-10T06:19:13Z")

</div>

!event["tags"].include?(@grok\_filter.tag\_on\_failure)  
return  
true !!!

thouth event["tags"] =\>[[0] "\_grokparsefailure\_sysloginput" ]  
@grok\_filter.tag\_on\_failure =\> [[0] "\_grokparsefailure\_sysloginput"]

It seems like a bug.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/the-output-dont-match-the-source-code-in-syslog-input-plugin/62593/3 "2017-07-06T04:34:57Z")

</div>