# How to send syslogs to logstash

**URL:** <https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244>\
**Category:** Logstash\
**Created:** [July 14, 2017, 8:33pm UTC](https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244 "2017-07-14T20:33:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\
**Post date:** [July 14, 2017, 8:33pm UTC](https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244/1 "2017-07-14T20:33:33Z")

</div>

I want to send syslog data to logstash.

I'm trying to do this with the beats [Syslog Output Plugin](https://github.com/logmatic/beats-forwarder/blob/master/docs/forwarder/syslog.md).

filebeat config:

```
filebeat:
  prospectors:
    -
      paths:
        - /var/log/messages
        - /var/log/audit/audit.log
      document_type: syslog
output:
  type: syslog
  syslog:
    network: udp
    raddr: ["localhost:1234"]

```

logstash config:

```
input {
  tcp {
    port => "1234"
    type => syslog
  }
}

```

Something must be wrong because filebeat wont start and I get these errors:  
`ERR Failed to publish events caused by: write tcp 127.0.0.1:55350->127.0.0.1:9999: write: connection reset by peer`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2017, 9:12pm UTC](https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244/2 "2017-07-14T21:12:10Z")

</div>

You seem to have configured Filebeat to send to localhost:1234 via UDP yet the error message indicates it's localhost:9999 via TCP. Are you really running the configuration you think you are?

---

<div class="post-metadata">

**Author:** ![red888](https://avatars.discourse-cdn.com/v4/letter/r/ecae2f/32.png) [@red888](https://discuss.elastic.co/u/red888)\
**Post date:** [July 17, 2017, 5:35am UTC](https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244/3 "2017-07-17T05:35:45Z")

</div>

Ah sorry that's a typo, the error did say the same port

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2017, 5:35am UTC](https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244/4 "2017-08-14T05:35:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.