How to configure Beat to log to a specific Syslog facility

stoth · June 5, 2019, 9:25pm

Hello, I've written a custom beat that I want to log to a specific Syslog facility. I'm aware of the configuration to enable logging to Syslog, but I can't figure out how to log to a specific Syslog facility (ex. LOCAL6)

Thanks in advance.

martinr_ubi · June 6, 2019, 2:43am

It’s hardcoded here:

github.com

elastic/beats/blob/10dca3e78f83b77769f566ce0f2fd0130e074531/libbeat/logp/syslog_unix.go#L41


type syslogCore struct {
	zapcore.LevelEnabler
	encoder zapcore.Encoder
	writer  *syslog.Writer
	fields  []zapcore.Field
}


// newSyslog returns a new Core that outputs to syslog.
func newSyslog(encoder zapcore.Encoder, enab zapcore.LevelEnabler) (zapcore.Core, error) {
	// Initialize a syslog writer.
	writer, err := syslog.New(syslog.LOG_ERR|syslog.LOG_LOCAL0, filepath.Base(os.Args[0]))
	if err != nil {
		return nil, errors.Wrap(err, "failed to get a syslog writer")
	}


	return &syslogCore{
		LevelEnabler: enab,
		encoder:      encoder,
		writer:       writer,
	}, nil
}

Useful ref:
https://golang.org/pkg/log/syslog/

stoth · June 6, 2019, 3:16pm

Thank you. I'll open a feature request to allow it be configured.

system · July 4, 2019, 3:16pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to configure syslog output in winlogbeat Beats winlogbeat	8	5568	July 24, 2018
Unable to customize the beats log storage location Beats	1	347	August 27, 2019
Can Winlogbeat output to syslog? Beats winlogbeat	3	1656	March 22, 2017
Syslog type Beats filebeat	9	1230	June 12, 2018
Filebeat Syslog isn't Opening Port Beats filebeat	5	1275	June 3, 2021

How to configure Beat to log to a specific Syslog facility

Related topics