Skip to content

Instantly share code, notes, and snippets.

@linnil1
Created September 17, 2023 06:03
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save linnil1/8e0bc11fe8d5c36b36f1c64c397d24ad to your computer and use it in GitHub Desktop.
Save linnil1/8e0bc11fe8d5c36b36f1c64c397d24ad to your computer and use it in GitHub Desktop.
logstash syslog config with support of rfc3164 and rfc5424 (using different port)
input {
syslog {
id => "syslog_rfc3164"
port => 1514
}
syslog {
id => "syslog_rfc5424"
port => 1515
grok_pattern => "%{SYSLOG5424LINE}"
tags => [ "rfc5424" ]
}
}
filter {
if "rfc5424" in [tags] {
mutate {
remove_field => ["system"]
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment