# How to integrate syslog input plugin **URL:** \ **Category:** Logstash\ **Created:** [December 11, 2023, 10:02am UTC](https://discuss.elastic.co/t/how-to-integrate-syslog-input-plugin/349025 "2023-12-11T10:02:33Z")\ **Posts on this page:** 3\ **Page:** 3
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [December 26, 2023, 12:21pm UTC](https://discuss.elastic.co/t/how-to-integrate-syslog-input-plugin/349025/41 "2023-12-26T12:21:35Z")
You can try if you like. ILM is a solution for you, and will help you to keep data for X days. Another approach is to remove unnecessary fields, which may include the event and message fields. Of course it's good to have the error handling and keep the original message. It requires few additional lines. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 26, 2023, 12:24pm UTC](https://discuss.elastic.co/t/how-to-integrate-syslog-input-plugin/349025/42 "2023-12-26T12:24:13Z")
> [@Ravi\_Pattar](#): > > ```auto > Dec 25 11:33:32 localhost systemd[1]: elasticsearch.service: Main process exited, code=killed, status=9/KILL > Dec 25 11:33:32 localhost systemd[1]: elasticsearch.service: Failed with result 'signal'. > > ``` Your elasticsearch service is getting killed, it is not running, you need to investigate why. This will be logged in the system logged, you need to check on `/var/log/syslog` for any hint why the Elasticsearch service cannot start. Try to start it again and check the log. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 26, 2024, 4:43am UTC](https://discuss.elastic.co/t/how-to-integrate-syslog-input-plugin/349025/44 "2024-01-26T04:43:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/how-to-integrate-syslog-input-plugin/349025.md?page=2)