syslog input plugin's grok semantics do not match RFC 3164; matching valid syslog messages fails (Logstash 1.4.2) #12
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
(This issue was originally filed by @PumpMagic at elastic/logstash#2552)
1.4.2's syslog input plugin (lib/logstash/inputs/syslog.rb) uses the grok syntax of "SYSLOGLINE". See line 58:
As far as I can tell, this "SYSLOGLINE" syntax is undefined in patterns/grok-patterns, much less anywhere. Valid syslog messages passed to the syslog input are tagged with _grokparsefailure and are assigned a default syslog priority.
The text was updated successfully, but these errors were encountered: