# Codec line not working as expected

**URL:** <https://discuss.elastic.co/t/codec-line-not-working-as-expected/126219>\
**Category:** Logstash\
**Created:** [March 30, 2018, 11:07am UTC](https://discuss.elastic.co/t/codec-line-not-working-as-expected/126219 "2018-03-30T11:07:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddebast](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddebast/32/17697_2.png) [@ddebast](https://discuss.elastic.co/u/ddebast)\
**Post date:** [March 30, 2018, 11:07am UTC](https://discuss.elastic.co/t/codec-line-not-working-as-expected/126219/1 "2018-03-30T11:07:19Z")

</div>

**logstash version logstash 5.4.1**

I have a beat input that ships logs from a linux host.  
What I'm receiving:

> "message" =\> "Mar 30 13:01:34 host su: pam\_unix(su-l:session): session closed for user user",

Since I want to forward this to a system in syslog format I mutate the field into another field

**Config:**

> ```
> mutate {
> add_field => { "ori_message" => "<13> %{message}" }
> }
> 
> ```

**Result:**

> "ori\_message" =\> "\<13\> Mar 30 13:01:34 svlipc99 su: pam\_unix(su-l:session): session closed for user infa",

I want to forward this field (only this field within output)

> ```
> udp {
> host => "<ip>"
> port => 514
> codec => line { format => "%{ori_message}" }
> }
> 
> ```

Result in the system where I receive the log:

> \<13\>**Mar 30 10:58:00 host LOGSTASH[-]:** Mar 30 12:57:56 host su: pam\_unix(su-l:session): session closed for user user

Why is logstash adding the part **Mar 30 10:58:00 host LOGSTASH[-]:**?

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 31, 2018, 1:15am UTC](https://discuss.elastic.co/t/codec-line-not-working-as-expected/126219/2 "2018-03-31T01:15:27Z")

</div>

Unfortunately I can't replicate.

I started a netcat server listening on a local port:

```auto
nc -lvup 2115

```

And created a pipeline config like the following:

```auto
input {
  stdin {}
}
filter {
  mutate {
    add_field => {
      "ori_message" => "<13> %{message}"
    }
  }
}
output {
  stdout {
    codec => rubydebug
  }
  udp {
    host => "127.0.0.1"
    port => 2115
    codec => line {
      format => "%{ori_message}"
    }
  }
}

```

When I echo your original message into logstash, I see a message on stdout that seems to have the right shape:

```auto
╭─{ yaauie@castrovel:~/src/elastic/discuss-scratch/126219-udp-codec }
╰─○ echo 'Mar 30 13:01:34 host su: pam_unix(su-l:session): session closed for user user' | "${LOGSTASH_5_4_1}/bin/logstash" -f pipeline.conf
Sending Logstash's logs to /Users/yaauie/src/elastic/releases/logstash-5.4.1/logs which is now configured via log4j2.properties
[2018-03-31T01:11:25,770][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000}
[2018-03-31T01:11:25,784][INFO][logstash.pipeline] Pipeline main started
[2018-03-31T01:11:25,819][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
{
     "@timestamp" => 2018-03-31T01:11:25.800Z,
    "ori_message" => "<13> Mar 30 13:01:34 host su: pam_unix(su-l:session): session closed for user user",
       "@version" => "1",
           "host" => "castrovel.local",
        "message" => "Mar 30 13:01:34 host su: pam_unix(su-l:session): session closed for user user"
}
[2018-03-31T01:11:28,800][WARN][logstash.agent] stopping pipeline {:id=>"main"}
[success (10.000s)]

```

And the netcat process that had been running gets a message that also seems appropriate, without injecting any additional content to the string:

```auto
╭─{ yaauie@castrovel:~ }
╰─○ nc -lvup 2115
Received packet from 127.0.0.1:65323 -> 127.0.0.1:2115 (local)
<13> Mar 30 13:01:34 host su: pam_unix(su-l:session): session closed for user user

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2018, 1:16am UTC](https://discuss.elastic.co/t/codec-line-not-working-as-expected/126219/3 "2018-04-28T01:16:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.