From 2630a9c6afc8ecfcc265c0257e9258df0d4cfe94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= <kvch@users.noreply.github.com>
Date: Tue, 19 Mar 2019 13:24:43 +0100
Subject: [PATCH] [Filebeat] Fix of syslog parsing for Priority value <0> (
 #11010 ) (#11288) (#11301)

(cherry picked from commit 96f3549fc08cf0b4d71a75162f5e80350f9835b9)
---
 CHANGELOG.next.asciidoc        | 1 +
 filebeat/input/syslog/event.go | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 2a75bddfdbd3..b93ea8aec304 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -113,6 +113,7 @@ https://github.com/elastic/beats/compare/v6.6.0...6.x[Check the HEAD diff]
 - Fix a bug with the convert_timezone option using the incorrect timezone field. {issue}11055[11055] {pull}11164[11164]
 - Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252]
 - Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256]
+- Add fix to parse syslog message with priority value 0. {issue}11010[11010]
 
 *Heartbeat*
 
diff --git a/filebeat/input/syslog/event.go b/filebeat/input/syslog/event.go
index 1ffcf074a756..30c17bdef162 100644
--- a/filebeat/input/syslog/event.go
+++ b/filebeat/input/syslog/event.go
@@ -216,7 +216,7 @@ func (s *event) Priority() int {
 
 // HasPriority returns if the priority was in original event.
 func (s *event) HasPriority() bool {
-	return s.priority > 0
+	return s.priority >= 0
 }
 
 // Severity returns the severity, will return -1 if priority is not set.