Nagios Support Forum

Getting "some" of our syslog events from ESX hosts showing up as _grokparsefailure.
We get millions of events from all our ESX nodes and all via syslog so not sure why some events are not parsing properly. This is just one example.

Any ideas?

Log Server 1.4

Are these events simply being sent to a syslog input, or are there any filters involved? If it's just the syslog input, let's observe the following:

Default syslog input filter: Your log: Plugging both of them into a debugger gives us the following result: Not the result we were looking for. After some playing around, it looks like your log doesn't match the syslog input because it doesn't match the standard syslog format: Notice that the default filter matches:
%{SYSLOGHOST:logsource} %{SYSLOGPROG}:

Meaning that the program must come immediately after the logsource. In a log that follows the format exactly, you'll see something like this:
Dec 14 08:51:01 localhost kernel:

For some reason your log includes the 'f46715f-f625-002481e8dc5 esxhost.me.net ' bit of information, which appears to throw out filter off. You'll likely have to design a custom filter to fit your ESXI syslogs:
http://support.nagios.com/forum/viewtop ... 37&t=32221
http://support.nagios.com/forum/viewtop ... 68#p134768
Less long:
http://support.nagios.com/forum/viewtop ... 28#p137728

This pattern may give you a good start:
https://github.com/harrytruman/logstash ... stash.conf