How to configure Beat to log to a specific Syslog facility

stoth · June 5, 2019, 9:25pm

Hello, I've written a custom beat that I want to log to a specific Syslog facility. I'm aware of the configuration to enable logging to Syslog, but I can't figure out how to log to a specific Syslog facility (ex. LOCAL6)

Thanks in advance.

martinr_ubi · June 6, 2019, 2:43am

It’s hardcoded here:

github.com

elastic/beats/blob/10dca3e78f83b77769f566ce0f2fd0130e074531/libbeat/logp/syslog_unix.go#L41


type syslogCore struct {
	zapcore.LevelEnabler
	encoder zapcore.Encoder
	writer  *syslog.Writer
	fields  []zapcore.Field
}


// newSyslog returns a new Core that outputs to syslog.
func newSyslog(encoder zapcore.Encoder, enab zapcore.LevelEnabler) (zapcore.Core, error) {
	// Initialize a syslog writer.
	writer, err := syslog.New(syslog.LOG_ERR|syslog.LOG_LOCAL0, filepath.Base(os.Args[0]))
	if err != nil {
		return nil, errors.Wrap(err, "failed to get a syslog writer")
	}


	return &syslogCore{
		LevelEnabler: enab,
		encoder:      encoder,
		writer:       writer,
	}, nil
}

Useful ref:
https://golang.org/pkg/log/syslog/

stoth · June 6, 2019, 3:16pm

Thank you. I'll open a feature request to allow it be configured.

system · July 4, 2019, 3:16pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.