<div dir="ltr">Hello,<div><br></div><div>Without knowing your logs, it is hard to say anything more. But I would be really surprised if the issue is with *filter* not working.</div><div>You could always run syslog-ng at debug/trace level in order to track which filter/destination is triggered with a message.</div><div><br></div><div><br></div><div><div id="m_-6161513358207291602m_-1534185044878085185gmail-main-content" class="m_-6161513358207291602m_-1534185044878085185gmail-wiki-content" style="margin:0px;padding:0px;color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px"><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-TextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="color:rgb(38,50,56)"><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">I don't want to push anything here, the only reason I write this note is that I started sensing a mismatch of what the community can provide and what you actually expect.</span></span><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0"> If you disagree, just ignore the rest of this email.<br></span></p><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:10px 0px 0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-TextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="color:rgb(38,50,56)"><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">If this is needed for a critical production deployment, I would consider the paid for syslog-ng Premium Edition offered by One Identity. The Open Source version of syslog-ng is not supported by a professional support team, community (that includes some of syslog-ng's developers) is usually helping on a best effort basis. I</span></span><span class="m_-6161513358207291602m_-1534185044878085185gmail-TextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="color:windowtext"><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">f you require faster answers (with SLAs), patched binary packages, or more in-depth guidance, </span></span><span class="m_-6161513358207291602m_-1534185044878085185gmail-TextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="color:windowtext"><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">One Identity offers paid support and/or consultancy services for syslog-ng. </span></span><span class="m_-6161513358207291602m_-1534185044878085185gmail-TextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="color:windowtext"><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">See </span></span><a class="m_-6161513358207291602m_-1534185044878085185external-link" href="https://www.syslog-ng.com/register/115497/" rel="nofollow" style="color:rgb(53,114,176);text-decoration-line:none" target="_blank"><span class="m_-6161513358207291602m_-1534185044878085185gmail-TextRun m_-6161513358207291602m_-1534185044878085185gmail-Underlined m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0"><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">https://www.syslog-ng.com/</span><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">register/115497/</span></span></a><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0"> </span></p><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:10px 0px 0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-TextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="color:rgb(38,50,56)"><span class="m_-6161513358207291602m_-1534185044878085185gmail-NormalTextRun m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">Disclaimer: I am employed by One Identity (being a software engineer there).</span></span><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0"> </span></p><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:10px 0px 0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0"><br></span></p><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:10px 0px 0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">--</span></p><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:10px 0px 0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0">Kokan</span></p><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:10px 0px 0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0"><br></span></p><p class="m_-6161513358207291602m_-1534185044878085185gmail-Paragraph m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0" style="margin:10px 0px 0px;padding:0px"><span class="m_-6161513358207291602m_-1534185044878085185gmail-EOP m_-6161513358207291602m_-1534185044878085185gmail-SCXO53162511 m_-6161513358207291602m_-1534185044878085185gmail-BCX0"><br></span></p></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Mar 23, 2019 at 4:38 PM Lin, Victor <<a href="mailto:victor.lin@rbc.com" target="_blank">victor.lin@rbc.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<font face="Calibri" size="2"><span style="font-size:11pt">
<div>Dear All,</div>
<div> </div>
<div> I am trying to forwarding all cisco IOS and Nexus to remote server</div>
<div>Here is from my syslog-ng.conf</div>
<div> </div>
<div>*********************</div>
<div># Syslog collection for all devices</div>
<div>source s_network {</div>
<div> network(</div>
<div> transport("udp")</div>
<div> port(514)</div>
<div> flags(syslog_protocol)</div>
<div> keep_hostname(yes)</div>
<div> keep_timestamp(yes)</div>
<div> use_dns(no)</div>
<div> use_fqdn(no)</div>
<div> );</div>
<div>};</div>
<div> </div>
<div>destination d_all_logs {</div>
<div> file("/app/syslog-ng/My_custom/My_output/all_devices.log");</div>
<div>};</div>
<div>#All syslogs</div>
<div>log {</div>
<div> source(s_network);</div>
<div> destination(d_all_logs);</div>
<div>};</div>
<div><font face="Times New Roman"> </font></div>
<div>*****************************</div>
<div>#Cisco to elastic Mar.22.2019</div>
<div>destination d_cisco_logs {</div>
<div> file("/app/syslog-ng/My_custom/My_output/cisco.log");</div>
<div> network("10.20.30.44" port(2514) transport(udp) spoof_source(yes));</div>
<div>};</div>
<div>*****************************************</div>
<div>#Cisco logs to elastic Mar.22.2019</div>
<div> </div>
<div>log {</div>
<div> source(s_network);</div>
<div> filter(f_cisco_message);</div>
<div> destination(d_cisco_logs);</div>
<div>};</div>
<div>***********************************</div>
<div>#Cisco to elastic Mar.22.2019</div>
<div>filter f_cisco_message {</div>
<div> match ("Cisco IOS", value ("MESSAGE"));</div>
<div style="text-indent:36pt">or</div>
<div style="text-indent:36pt">match ("Cisco Nexus", value ("MESSAGE"));</div>
<div style="text-indent:9pt"> };</div>
<div style="text-indent:9pt"><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div>But looks like cisco.log is never have any data inside.</div>
<div>Below is from </div>
<div><font face="Times New Roman"> </font></div>
<div>Could you please review my config and advice ?</div>
<div> </div>
<div>Thank you so much for your reply in advance!</div>
<div> </div>
<div>VL</div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
</span></font>
<p><font style="font-size:9pt">_______________________________________________________________________</font></p>
<p><font style="font-size:9pt">If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference.</font></p>
<p><font style="font-size:9pt">Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. </font></p>
<p></p></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div><span>
</span>