# Logstash-output-syslog-3.0.5 not sending UDP over IPv6

**URL:** <https://discuss.elastic.co/t/logstash-output-syslog-3-0-5-not-sending-udp-over-ipv6/307279>\
**Category:** Logstash\
**Created:** [June 15, 2022, 1:14pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-3-0-5-not-sending-udp-over-ipv6/307279 "2022-06-15T13:14:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ben2015](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@ben2015](https://discuss.elastic.co/u/ben2015)\
**Post date:** [June 15, 2022, 1:14pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-3-0-5-not-sending-udp-over-ipv6/307279/1 "2022-06-15T13:14:06Z")

</div>

I'm trying to use logstash-output-syslog-3.0.5 with protocol UDP and an IPv6 address.

It fails in connect, at line 209 of `logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-syslog-3.0.5/lib/logstash/outputs/syslog.rb`:

i.e.

208: `socket = UDPSocket.new`  
209: `socket.connect(@host, @port)` \<-- fails here, if `@host` is an IPv6 address.

If I change line 208 to explicitly use IPv6 it works.

i.e.

208: `socket = UDPSocket.new(Socket::AF_INET6)`  
209: `socket.connect(@host, @port)` \<-- this now works when `@host` is an IPv6 address.

Presumably, I've now broken it for IPv4, which isn't an issue for me, but a proper fix should handle both IPv4 and IPv6.

Absent my change, it works with IPv4, and it works with TCP, it's just the combination of UDP and IPv6 that fails.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 15, 2022, 3:00pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-3-0-5-not-sending-udp-over-ipv6/307279/2 "2022-06-15T15:00:18Z")

</div>

It seems that the plugin only supports UDP with IPv4 and would need some changes to support both.

I do not know much about ruby, but looking at how other plugins deals with that, maybe it is a simple change.

For example, the `logstash-input-syslog` plugins use the following line to create a new UDP socket.

```auto
 @udp = UDPSocket.new (IPAddr.new(@host).ipv6? rescue nil) ? Socket::AF_INET6 : Socket::AF_INET

```

So, maybe if you change the `logstash-output-syslog` line 208 to:

```auto
socket = UDPSocket.new (IPAddr.new(@host).ipv6? rescue nil) ? Socket::AF_INET6 : Socket::AF_INET

```

It would work with UDP for both IPv4 and IPv6.

Can you test that? If it work maybe you can submit a pull request to github.

The `logstash-input-udp` has a similar approach where it also tests if the IP address is a IPv6 or IPv4.

```auto
    if IPAddr.new(@host).ipv6?
      @udp = UDPSocket.new(Socket::AF_INET6)
    elsif IPAddr.new(@host).ipv4?
      @udp = UDPSocket.new(Socket::AF_INET)
    end

```

---

<div class="post-metadata">

**Author:** ![ben2015](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@ben2015](https://discuss.elastic.co/u/ben2015)\
**Post date:** [June 17, 2022, 4:04am UTC](https://discuss.elastic.co/t/logstash-output-syslog-3-0-5-not-sending-udp-over-ipv6/307279/3 "2022-06-17T04:04:28Z")

</div>

The `logstash-input-udp` approach looks cleaner.

Except that, and maybe I'm missing something, `IPAddr.new` only seems to work for numeric IP addresses - it fails if given a hostname.

I suppose it would be possible to try IPv4 and then if that fails, start over and try IPv6. Hardly elegant.

The other thing that module needs is error messages and maybe some extra info or debug messages.

---

<div class="post-metadata">

**Author:** ![ben2015](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@ben2015](https://discuss.elastic.co/u/ben2015)\
**Post date:** [June 17, 2022, 12:25pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-3-0-5-not-sending-udp-over-ipv6/307279/4 "2022-06-17T12:25:56Z")

</div>

Defect raised: [logstash-output-syslog-3.0.5 with protocol UDP and an IPv6 address fails in connect · Issue #60 · logstash-plugins/logstash-output-syslog · GitHub](https://github.com/logstash-plugins/logstash-output-syslog/issues/60)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2022, 12:26pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-3-0-5-not-sending-udp-over-ipv6/307279/5 "2022-07-15T12:26:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.