# What analyzer for network device syslogs

**URL:** <https://discuss.elastic.co/t/what-analyzer-for-network-device-syslogs/46251>\
**Category:** Elasticsearch\
**Created:** [April 4, 2016, 3:00pm UTC](https://discuss.elastic.co/t/what-analyzer-for-network-device-syslogs/46251 "2016-04-04T15:00:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Antoine\_Brun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoine_brun/32/3774_2.png) [@Antoine\_Brun](https://discuss.elastic.co/u/Antoine_Brun)\
**Post date:** [April 4, 2016, 3:00pm UTC](https://discuss.elastic.co/t/what-analyzer-for-network-device-syslogs/46251/1 "2016-04-04T15:00:06Z")

</div>

Hello,

currently we are indexing some UTM syslogs with the default analyzer:  
example of log:

\<185\>date=2016-04-04  
time=18:10:48 log\_id=20000010 msg\_id=000000020218  
device\_id=FVVM020000043660 vd="root"  
timezone="(GMT+9:00)Osaka,Sapporo,Tokyo,Seoul" type=attack  
subtype="waf\_signature\_detection" pri=alert trigger\_policy=""  
severity\_level=Low proto=tcp service=http action=Alert\_Deny  
policy="POL\_Web-02" src=9.8.7.6 src\_port=55645 dst=1.2.3.4  
dst\_port=80 http\_method=get http\_url="/DoNotDelete/healthcheck.txt"  
http\_host="[www3.arrowgate.com](http://www3.arrowgate.com)" http\_agent="Wget/1.12 (linux-gnu)"  
http\_session\_id=none msg="[Signatures name: Product\_sig] [main class  
name: Bad Robot]: 110000003" signature\_subclass="Bad Robot"  
signature\_id="110000003" srccountry="United States"  
content\_switch\_name="none" server\_pool\_name="Web-02\_11.22.99.99"

mapping

"rawlog": {  
"type": "string",  
"store": "no",  
"index": "analyzed",  
"index\_options": "offsets",  
"doc\_values": false  
}

I read that this may not be the most efficient one for this kind of usage.

Is there a more suitable analyser that we should use?

Antoine

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 4, 2016, 11:52pm UTC](https://discuss.elastic.co/t/what-analyzer-for-network-device-syslogs/46251/2 "2016-04-04T23:52:16Z")

</div>

> [@Antoine\_Brun](#):
>
> I read that this may not be the most efficient one for this kind of usage.

Read where?

---

<div class="post-metadata">

**Author:** ![Antoine\_Brun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoine_brun/32/3774_2.png) [@Antoine\_Brun](https://discuss.elastic.co/u/Antoine_Brun)\
**Post date:** [April 5, 2016, 6:25am UTC](https://discuss.elastic.co/t/what-analyzer-for-network-device-syslogs/46251/3 "2016-04-05T06:25:43Z")

</div>

```
    1
    down vote

```

[elasticsearch-queries-slow-performance](http://stackoverflow.com/questions/26628959/elasticsearch-queries-slow-performance)

To add to Torsten Engelbrecht's answer, default analyzer might be  
part of the culprit. This analyzer will index every form of each word as  
a separate token, meaning that a single verb in a language with complex  
conjugation can be indexed a dozen times. Also, that degrades the  
quality of the search results. The same applies if your documents  
contain formatting information (HTML markup ?).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:02pm UTC](https://discuss.elastic.co/t/what-analyzer-for-network-device-syslogs/46251/4 "2017-07-05T23:02:23Z")

</div>