# What is the number prefix in less-than/greater-than signs in the Message Field, before Date **URL:** \ **Category:** Logstash\ **Created:** [August 9, 2019, 2:07pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630 "2019-08-09T14:07:14Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![samk137](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samk137/32/52031_2.png) [@samk137](https://discuss.elastic.co/u/samk137)\ **Post date:** [August 9, 2019, 2:07pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/1 "2019-08-09T14:07:14Z")
Hello, I'm new to the ELK stack and am having trouble figuring out something that's coming through in all my logs. The 'message' field stars with a \<##\>MMM DD HH:MM:SS I cannot for the life of me figure out what the \<##\> is supposed to be, why its attached to the month without a space, etc. What is the term for that field, and what information is it supplying? Is it supposed to be there? Will it cause any filters to fail? My current date filter is failing, and I thought my grok filter was failing because of it too until I used a simpler grok and started to build up. Also, my message field repeats after a comma for some reason. Here are samples of the output: > tags:\_dateparsefailure host:10.1.3.66 syslog\_timestamp:Aug 9 09:44:10 @timestamp:Aug 9, 2019 @ 09:44:11.255 syslog\_facility:user-level syslog\_facility\_code:1 @version:1 type:syslog syslog\_severity:notice syslog\_severity\_code:5 received\_at:2019-08-09T13:44:11.255Z received\_from:10.1.3.66 message:\<4\>Aug 9 09:44:10 ("U7LT,44d9e7fc371e,v3.9.42.9152") kernel: [12250717.020000] rx\_clear=100, rx\_frame=0, tx\_frame=0 , ("U7LT,44d9e7fc371e,v3.9.42.9152") kernel: [12250717.020000] rx\_clear=100, rx\_frame=0, tx\_frame=0 \_id:pZ6fdmwBYAcnd78aXWpf \_type:\_doc \_index:syslog-2019.08.09 \_score: - > tags:\_dateparsefailure host:192.168.100.215 syslog\_timestamp:Aug 9 09:44:08 @timestamp:Aug 9, 2019 @ 09:44:08.172 syslog\_facility:user-level syslog\_facility\_code:1 @version:1 type:syslog syslog\_severity:notice syslog\_severity\_code:5 received\_at:2019-08-09T13:44:08.172Z received\_from:192.168.100.215 message:\<86\>Aug 9 09:44:08 U7PG2,f09fc2c8513e,v4.0.42.10433: dropbear[31972]: Exit before auth: Exited normally, U7PG2,f09fc2c8513e,v4.0.42.10433: dropbear[31972]: Exit before auth: Exited normally \_id:Q56fdmwBYAcnd78aUWlV \_type:\_doc \_index:syslog-2019.08.09 \_score: - Those are my syslogs, running through this config: > input { > tcp { > port =\> 1514 > type =\> syslog > } > udp { > port =\> 1514 > type =\> syslog > } > } > filter { > if [type] == "syslog" { > grok { > #match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } > match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{GREEDYDATA:message}" } > > add\_field =\> ["received\_at", "%{@timestamp}"] > add\_field =\> ["received\_from", "%{host}"] > } > syslog\_pri { } > date { > match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] > } > } > } > output { > elasticsearch { > hosts =\> ["localhost:9200"] > sniffing =\> true > manage\_template =\> false > index =\> "syslog-%{+YYYY.MM.dd}" > } > } I have a second input pipeline that takes our firewall messages that have a lot more and different formatting. I am using kv and csv filters. There is no parse failure, but I still have this \<##\> field connected to the month. Because I am using KV here and my regex skills are probably not as developed as they could be I end up with this: > type:sonicwall host:192.168.1.99 @timestamp:Aug 9, 2019 @ 10:02:46.410 data.vpnpolicy:Brackney Tunnel data.time:2019-08-09 07:02:46 data.dstip:192.168.200.5 data.fw:\ data.c:262144 data.n:25456292 data.srciface:X1 data.m:98 **data.\<134\>id** :ea\_firewall data.srcip:10.1.1.170 data.gcat:4 data.proto:tcp/22 data.pri:6 data.srcport:41067 data.dstport:22 data.dstiface:X0 data.sn:18B169D1CA60 data.sent:60 @version:1 \_id:\_qCwdmwBYAcnd78aYXH0 \_type:\_doc \_index:sonicwall-2019.08.09 \_score: - > input { > tcp { > port =\> 5514 > type =\> sonicwall > } > udp { > port =\> 5514 > type =\> sonicwall > } > } > filter { > if [type] == "sonicwall" { > # grok { > # match =\> { "message" =\> "%{GREEDYDATA:message}" } > # } > kv { > source =\> "message" > target =\> "data" > } > # Sonicwall src field > csv { > source =\> "[data][src]" > separator =\> ":" > columns =\> ["srcip","srcport","srciface","srcname"] > target =\> "data" > } > # Sonicwall dst field > csv { > source =\> "[data][dst]" > separator =\> ":" > columns =\> ["dstip","dstport","dstiface","dstname"] > target =\> "data" > } > # Sonicwall natsrc field > csv { > source =\> "[data][natSrc]" > separator =\> ":" > columns =\> ["natsrcip","natsrcport"] > target =\> "data" > } > # Sonicwall natdst field > csv { > source =\> "[data][natDst]" > separator =\> ":" > columns =\> ["natdstip","natdstport"] > target =\> "data" > } > mutate > { > remove\_field =\> ["message"] > remove\_field =\> ["[data][src]" ] > remove\_field =\> ["[data][dst]" ] > remove\_field =\> ["[data][natSrc]" ] > remove\_field =\> ["[data][natDst]" ] > } > } > } > output { > elasticsearch { > hosts =\> ["localhost:9200"] > sniffing =\> true > manage\_template =\> false > index =\> "sonicwall-%{+YYYY.MM.dd}" > } > } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 9, 2019, 2:26pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/2 "2019-08-09T14:26:20Z")
> [@samk137](#): > > I cannot for the life of me figure out what the \<##\> is supposed to be That is a syslog PRI field. What does the input look like? ---
**Author:** ![samk137](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samk137/32/52031_2.png) [@samk137](https://discuss.elastic.co/u/samk137)\ **Post date:** [August 9, 2019, 2:43pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/3 "2019-08-09T14:43:16Z")
Ahh! Thank you. I was wondering if that was the case, but I couldn't make the number match with anything. Now that I see its a (Facility x 8 + Severity) that makes much more sense. Is there any easier way to inspect my input other than creating a very simple pipeline with only input and output? I haven't quite figured that out either, or if that method is even 100% accurate. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 9, 2019, 2:47pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/4 "2019-08-09T14:47:46Z")
> [@samk137](#): > > Is there any easier way to inspect my input other than creating a very simple pipeline with only input and output? That would work. Use ``` output { stdout { codec => rubydebug } } ``` ---
**Author:** ![samk137](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samk137/32/52031_2.png) [@samk137](https://discuss.elastic.co/u/samk137)\ **Post date:** [August 9, 2019, 3:30pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/5 "2019-08-09T15:30:28Z")
Ok, here are some samples: > { > "message" =\> "\<4\>Aug 9 11:20:28 ("U7LT,44d9e7fc371e,v3.9.42.9152") kernel: [12256494.680000] rx\_clear=99, rx\_frame=0, tx\_frame=0\n", > "type" =\> "syslog", > "host" =\> "10.1.3.66", > "@version" =\> "1", > "@timestamp" =\> 2019-08-09T15:20:28.954Z > } > { > "message" =\> "\<86\>Aug 9 11:20:29 U7PG2,f09fc2c852dc,v4.0.42.10433: dropbear[7518]: Child connection from 10.1.1.170:40147", > "type" =\> "syslog", > "host" =\> "192.168.100.210", > "@version" =\> "1", > "@timestamp" =\> 2019-08-09T15:20:29.055Z > } and a few that come from the SonicWall > { > "@version" =\> "1", > "@timestamp" =\> 2019-08-09T15:27:35.169Z, > "host" =\> "10.1.1.1", > "type" =\> "sonicwall", > "message" =\> "\<134\> id=firewall sn=18B169CDF644 time="2019-08-09 11:27:35" fw=\ pri=6 c=1024 gcat=6 m=537 msg="Connection Closed" srcMac=2c:41:38:ab:10:e6 src=10.1.1.205:49543:X0 srcZone=LAN natSrc=\:7546 dstMac=f4:b5:2f:0e:74:4c dst=93.184.220.29:80:X1 dstZone=WAN natDst=93.184.220.29:80 proto=tcp/http sent=508 rcvd=1034 spkt=6 rpkt=4 cdur=62616 rule="12 (LAN-\>WAN)" app=49175 appName="General HTTP" n=36206708" > } ---
**Author:** ![samk137](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samk137/32/52031_2.png) [@samk137](https://discuss.elastic.co/u/samk137)\ **Post date:** [August 9, 2019, 3:36pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/6 "2019-08-09T15:36:27Z")
So, it seems the Sonicwall has a space, just about everything else (So far I've only pointed our firewalls, switches [Cisco, HP, Netgear and Ubiquiti] and APs [Ubiquiti] to ELK) does not. Are there standard filters that may account for this (and extrapolate a facility and severity from that number)? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 9, 2019, 3:48pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/7 "2019-08-09T15:48:34Z")
There is a [syslog\_pri](https://www.elastic.co/guide/en/logstash/current/plugins-filters-syslog_pri.html) filter. For the syslog messages I would start with ``` dissect { mapping => { "message" => "<%{pri}>%{ts} %{+ts} %{+ts} %{restOfLine}" } } ``` For the sonicwall messages kv will ignore the \ so your filter configuration looks good to me. ---
**Author:** ![samk137](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samk137/32/52031_2.png) [@samk137](https://discuss.elastic.co/u/samk137)\ **Post date:** [August 9, 2019, 4:01pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/8 "2019-08-09T16:01:21Z")
Thank you so much for the help! So with the sonicwall, it is not ignoring the PRI. It's treating it as part of the ID= header, so I have fields that show up like: ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7bbe1e11826a312e348042b509a0ca9c8f8d6b12.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 9, 2019, 4:23pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/9 "2019-08-09T16:23:30Z")
In 7.3.0 I see it being ignored. Still, easy enough to use mutate+gsub to remove it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 6, 2019, 4:29pm UTC](https://discuss.elastic.co/t/what-is-the-number-prefix-in-less-than-greater-than-signs-in-the-message-field-before-date/194630/10 "2019-09-06T16:29:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.