<div dir="ltr"><div dir="auto" style="word-wrap:break-word">Thanks Tibor and Laszlo, I will explore both of these options.</div><div dir="auto" style="word-wrap:break-word"><br></div><div dir="auto" style="word-wrap:break-word">=Nadine=<br><div><br>--<br>Nadine Miller<br>Principal Security Engineer<br>email: <a href="mailto:nadine.miller@defpoint.com" target="_blank">nadine.miller@defpoint.com</a><br>phone: <a href="tel:%28408%29%20667-9004" value="+14086679004" target="_blank">(408) 667-9004</a> (Eastern)<br></div><br><blockquote type="cite">On Oct 16, 2015, at 4:04 AM, Tibor Benke &lt;<a href="mailto:ihrwein@gmail.com" target="_blank">ihrwein@gmail.com</a>&gt; wrote:<br><br>Maybe the csv-parser would also work with space as a separator character.<br><br>2015-10-16 9:53 GMT+02:00 Budai, László &lt;<a href="mailto:laszlo.budai@balabit.com" target="_blank">laszlo.budai@balabit.com</a>&gt;:<br>Hi,<br><br>a more specific example that I&#39;ve created (just a POC):<br><br>@version: 3.7<br>@include &quot;scl.conf&quot;<br><br>#PROXY_STRING + single space + INET_PROTOCOL + single space + CLIENT_IP + single space + PROXY_IP + single space + CLIENT_PORT + single space + PROXY_PORT + &quot;\r\n&quot;<br>python {<br>import socket<br>import json<br>def aws_elb_proxy_protocol2json(logmsg, arg):<br>  out = {}<br>  token_separator = &#39; &#39;<br>  tokens = arg.split(token_separator)<br>  if not tokens or len(tokens) &lt; 6:<br>    return json.dumps({&quot;aws_elb_proxy_protocol2json.error&quot;: &quot;split failure&quot;, &quot;message&quot;: arg})<br><br>  out[&quot;proxy&quot;] = tokens[0]<br>  out[&quot;inet_protocol&quot;] = tokens[1]<br>  out[&quot;client_ip&quot;] = tokens[2]<br>  out[&quot;proxy_ip&quot;] = tokens[3]<br>  out[&quot;client_port&quot;] = tokens[4]<br>  out[&quot;proxy_port&quot;] = tokens[5]<br><br>  return json.dumps(out)<br>};<br><br>block parser aws_elb2json (<br>  template(&quot;${MSG}&quot;)<br>  rec-sep(&#39; &#39;)<br>  field-sep(&#39; &#39;)<br>) {<br>  json-parser(template(&quot;$(python aws_elb_proxy_protocol2json `template`)&quot;));<br>};<br> <br>source s_aws_elb {<br>  file(&quot;/tmp/aws-elb.log&quot; flags(no-parse));<br>};<br> <br>destination d_client_port_odd_json {<br>    file(&quot;/tmp/aws_elb_client_port_odd_json.log&quot; template(&quot;$(format-json -s nv-pairs)\n&quot;));<br>};<br><br>destination d_client_port_even {<br>    #file(&quot;/tmp/aws_elb_client_port_even.log&quot; template(&quot;$(format-json -s nv-pairs)\n&quot;));<br>    file(&quot;/tmp/aws_elb_client_port_even.log&quot;);<br>};<br> <br>filter f_client_port_odd { match(&quot;\d*[13579]$&quot; value(&quot;client_port&quot;)); };<br>filter f_client_port_even { match(&quot;\d*[02468]$&quot; value(&quot;client_port&quot;)); };<br><br>log {<br>    source(s_aws_elb);<br>    parser { aws_elb2json(); };<br><br>    filter(f_client_port_odd);<br>    destination(d_client_port_odd_json);<br>};<br><br>log {<br>    source(s_aws_elb);<br>    parser { aws_elb2json(); };<br><br>    filter(f_client_port_even);<br>    destination(d_client_port_even);<br>};<br><br><br>regards,<br>L.<br><br>On Thu, Oct 15, 2015 at 7:28 PM, Nadine Miller &lt;<a href="mailto:nadine.miller@defpoint.com" target="_blank">nadine.miller@defpoint.com</a>&gt; wrote:<br>I&#39;ve searched through the archives and spent some time trying to find<br>possible answers on the web, but haven&#39;t found a definitive answer.<br><br>I&#39;m in a situation where I need to parse syslog streams being<br>forwarded through an AWS ELB. The normal configuration of the ELB<br>resets the source IP to be the ELB&#39;s IP address. Logs are coming from<br>multiple AWS VPCs, and we&#39;ve already discovered duplicate hostnames<br>across different VPCs, which has mingled logs from different hosts<br>into one receiving log file.<br><br>The ELB has another mode, referred to as &quot;Proxy Protocol&quot; which adds a<br>single line to the TCP stream in the form:<br><br>PROXY_STRING + single space + INET_PROTOCOL + single space + CLIENT_IP<br>+ single space + PROXY_IP + single space + CLIENT_PORT + single space<br>+ PROXY_PORT + &quot;\r\n&quot;<br><br>Example:<br><br>PROXY TCP4 198.51.100.22 203.0.113.7 35646 80\r\n<br><br>Is it possible to use this proxy line in syslog-ng to properly<br>segregate the log messages? If so, what would be the best method to<br>use? I&#39;ve done a lot of filtering/templating with normal UDP syslog<br>and syslog-ng, but this is the first time I&#39;ve had to consider<br>something crazy like this.<br><br>Currently there is no option at this time to change configurations at<br>endpoints sending the  syslog messages, nor can we remove the ELB.<br><br>For reference:<br><a href="http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-proxy-protocol.html" target="_blank">http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-proxy-protocol.html</a><br><br>Thanks in advance--<br>=N=<br>______________________________________________________________________________<br>Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br><br><br><br>______________________________________________________________________________<br>Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br><br><br><br>______________________________________________________________________________<br>Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br><br></blockquote><br></div></div>