Use the GROK function in DSL to parse Syslog logs in different formats-Simple Log Service(SLS)-阿里云帮助中心

Overview

Syslog is widely used for system logs on Unix-like operating systems. Syslog messages can be recorded in local files or sent over the network to a receiving server. The server can centrally store Syslog messages from multiple devices or parse their content for further processing.

Problem

For a long time, no standard existed to regulate the Syslog format, resulting in inconsistent formatting or no defined format at all. This makes Syslog messages difficult to parse programmatically, as they can often only be treated as plain strings. Understanding how to parse Syslog logs in various formats is therefore essential.

Video tutorial

Introduction to Syslog protocol standards

Two common Syslog protocols are used in the industry: RFC 5424 (published in 2009) and RFC 3164 (published in 2001). The following sections describe the differences between these two protocols. Understanding these differences helps you use GROK to flexibly parse Syslog logs.

RFC 5424 protocol

The RFC 5424 protocol includes the following fields. For more information, see the official protocol document.

PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID

The following examples describe these fields:

"""
Example1:
<34>1 2019-07-11T22:14:15.003Z aliyun.example.com ali - ID47 - BOM'su user' failed for lonvick on /dev/pts/8
"""
PRI -- 34
VERSION -- 1
TIMESTAMP -- 2019-07-11T22:14:15.003Z
HOSTNAME -- aliyun.example.com
APP-NAME -- ali
PROCID -- None
MSGID -- ID47
MESSAGE -- 'su user' failed for lonvick on /dev/pts/8
"""
Example2:
<165>1 2019-07-11T22:14:15.000003-07:00 192.0.2.1 myproc 8710 - - %% It's time to make the do-nuts.
"""
PRI -- 165
VERSION -- 1
TIMESTAMP -- 2019-07-11T05:14:15.000003-07:00
HOSTNAME -- 192.0.2.1
APP-NAME -- myproc
PROCID -- 8710
STRUCTURED-DATA -- "-"
MSGID -- "-"
MESSAGE -- "%% It's time to make the do-nuts."
"""
Example3: - with STRUCTURED-DATA
<165>1 2019-07-11T22:14:15.003Z aliyun.example.com
           evntslog - ID47 [exampleSDID@32473 iut="3" eventSource=
           "Application" eventID="1011"] BOMAn application
           event log entry...
"""
PRI -- 165
VERSION -- 1
TIMESTAMP -- 2019-07-11T22:14:15.003Z
HOSTNAME -- aliyun.example.com
APP-NAME -- evntslog
PROCID -- "-"
MSGID -- ID47
STRUCTURED-DATA -- [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"]
MESSAGE -- An application event log entry...

RFC 3164 protocol

The RFC 3164 protocol includes the following fields. For more information, see the official protocol document.

PRI HEADER[TIME HOSTNAME] MSG

The following example describes these fields:

"""
<30>Oct 9 22:33:20 hlfedora auditd[1787]: The audit daemon is exiting.
"""
PRI -- 30
HEADER
- TIME -- Oct 9 22:33:20
- HOSTNAME -- hlfedora
MSG
- TAG -- auditd[1787]
- Content -- The audit daemon is exiting.

Use GROK to parse common Syslog formats

You can use GROK to parse several common Syslog formats. For more information about GROK rules, see GROK pattern reference.

Parse the TraditionalFormat format

Raw log

  receive_time: 1558663265
  __topic__:
  content: May  5 10:20:57 iZbp1a65x3r1vhpe94fi2qZ systemd: Started System Logging Service.

SLS DSL rule

e_regex('content', grok('%{SYSLOGBASE} %{GREEDYDATA:message}'))

Processing result

  receive_time: 1558663265
  __topic__:
  content: May  5 10:20:57 iZbp1a65x3r1vhpe94fi2qZ systemd: Started System Logging Service.
  timestamp: May  5 10:20:57
  logsource: iZbp1a65x3r1vhpe94fi2qZ
  program: systemd
  message: Started System Logging Service.

Parse the FileFormat

Raw log

  receive_time: 1558663265
  __topic__:
  content: 2019-05-06T09:26:07.874593+08:00 iZbp1a65x3r1vhpe94fi2qZ user: 834753

SLS DSL rule

e_regex('content',grok('%{TIMESTAMP_ISO8601:timestamp} %{SYSLOGHOST:hostname} %{SYSLOGPROG} %{GREEDYDATA:message}'))

Processing result

  receive_time: 1558663265
  __topic__:
  content: 2019-05-06T09:26:07.874593+08:00 iZbp1a65x3r1vhpe94fi2qZ user: 834753
  timestamp: 2019-05-06T09:26:07.874593+08:00
  hostname: iZbp1a65x3r1vhpe94fi2qZ
  program: user
  message: 834753

Parse logs in RSYSLOG_SyslogProtocol23Format

Raw log

  receive_time: 1558663265
  __topic__:
  content: <13>1 2019-05-06T11:50:16.015554+08:00 iZbp1a65x3r1vhpe94fi2qZ user - - - twish

SLS DSL rule

e_regex('content',grok('%{POSINT:priority}>%{NUMBER:version} %{TIMESTAMP_ISO8601:timestamp} %{SYSLOGHOST:hostname} %{PROG:program} - - - %{GREEDYDATA:message}'))

Processing result

  receive_time: 1558663265
  __topic__:
  content: <13>1 2019-05-06T11:50:16.015554+08:00 iZbp1a65x3r1vhpe94fi2qZ user - - - twish
  priority: 13
  version: 1
  timestamp: 2019-05-06T11:50:16.015554+08:00
  hostname: iZbp1a65x3r1vhpe94fi2qZ
  program: user
  message: twish

Parse the RSYSLOG_DebugFormat format

Raw log

  receive_time: 1558663265
  __topic__:
  content: 2019-05-06T14:29:37.558854+08:00 iZbp1a65x3r1vhpe94fi2qZ user: environment

SLS DSL rule

e_regex('content',grok('%{TIMESTAMP_ISO8601:timestamp} %{SYSLOGHOST:hostname} %{SYSLOGPROG} %{GREEDYDATA:message}'))

Processing result

  receive_time: 1558663265
  __topic__:
  content: 2019-05-06T14:29:37.558854+08:00 iZbp1a65x3r1vhpe94fi2qZ user: environment
  timestamp: 2019-05-06T14:29:37.558854+08:00 
  hostname: iZbp1a65x3r1vhpe94fi2qZ
  program: user
  message: environment

Use GROK to parse uncommon Syslog log formats

You can use GROK to parse two uncommon Syslog formats used by Fluentd: FluentRFC5424 and FluentRFC3164.

FluentRFC5424 format

Raw log

  receive_time: 1558663265
  __topic__:
  content: <16>1 2019-02-28T12:00:00.003Z 192.168.0.1 aliyun 11111 ID24224 [exampleSDID@20224 iut='3' eventSource='Application' eventID='11211] Hi, from Fluentd!

SLS DSL rule

e_regex('content',grok('%{POSINT:priority}>%{NUMBER:version} %{TIMESTAMP_ISO8601:timestamp} %{SYSLOGHOST:hostname} %{WORD:ident} %{USER:pid} %{USERNAME:msgid} (?P<extradata>(\[(.*)\]|[^ ])) %{GREEDYDATA:message}'))

Processing result

  receive_time: 1558663265
  __topic__:
  content: <16>1 2019-02-28T12:00:00.003Z 192.168.0.1 aliyun 11111 ID24224 [exampleSDID@20224 iut='3' eventSource='Application' eventID='11211] Hi, from aliyun!
  priority: 16
  version: 1
  timestamp: 2019-02-28T12:00:00.003Z
  hostname: 192.168.0.1
  ident: aliyun
  pid: 11111
  msgid: ID24224
  extradata: [exampleSDID@20224 iut='3' eventSource='Application' eventID='11211]
  message: Hi, from aliyun!

FluentRFC3164 format

Raw log

  receive_time: 1558663265
  __topic__:
  content: <6>Feb 28 12:00:00 192.168.0.1 aliyun[11111]: [error] Syslog test

SLS DSL rule

e_regex('content', grok('%{POSINT:priority}>%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:hostname} %{WORD:ident}(?P<pid>(\[[a-zA-Z0-9._-]+\]|[^:])): (?P<level>(\[(\w+)\]|[^ ])) %{GREEDYDATA:message}'))

Processing result

 receive_time: 1558663265
  __topic__:
  content: <6>Feb 28 12:00:00 192.168.0.1 aliyun[11111]: [error] Syslog test
  priority: 6
  timestamp: Feb 28 12:00:00
  hostname: 192.168.0.1
  ident: aliyun
  pid: [11111]
  level: [error]
  message: Syslog test

Extended priority parsing

After you parse Syslog logs in FluentRFC5424 or FluentRFC3164 format, you can further parse the priority field to extract facility and severity information. For more information, see e_syslogrfc. The following is an example:

Raw log

receive_time: 1558663265
  __topic__:
  content: <13>1 2019-05-06T11:50:16.015554+08:00 iZbp1a65x3r1vhpe94fi2qZ user - - - twish
  priority: 13
  version: 1
  timestamp: 2019-05-06T11:50:16.015554+08:00
  hostname: iZbp1a65x3r1vhpe94fi2qZ
  program: user
  message: twish

SLS DSL rule
```
e_syslogrfc("priority","SYSLOGRFC5424")
```

Processing result

  receive_time: 1558663265
  __topic__:
  content: <13>1 2019-05-06T11:50:16.015554+08:00 iZbp1a65x3r1vhpe94fi2qZ user - - - twish
  priority: 13
  version: 1
  timestamp: 2019-05-06T11:50:16.015554+08:00
  hostname: iZbp1a65x3r1vhpe94fi2qZ
  program: user
  message: twish
  _facility_: 1
  _severity_: 5
  _severitylabel_: Notice: normal but significant condition
  _facilitylabel_: user-level messages