# Logstash-output-syslog full json in message? **URL:** \ **Category:** Logstash\ **Created:** [August 1, 2018, 7:02pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642 "2018-08-01T19:02:19Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Post date:** [August 1, 2018, 7:02pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/1 "2018-08-01T19:02:19Z")
Hi, I'm sending filebeat data to logstash and from there I send a copy to elastic and another to a 3rd party SIM which only supports syslog. Is there a way to send the full json line in the message without adding a bunch of specific fields to the message output? I understand there are RFC limits to the message size but mine are pretty small. Using message =\> "%{full\_log}" but it still missing a lot of data. Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2018, 8:07pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/2 "2018-08-01T20:07:59Z")
If you really want the whole event, you can add a field to the event that contains the whole event. Something like ``` ruby { code => ' event.set("everything!", event.to_json) ' } ``` Then use this on the syslog output ``` message => "everything!" ``` It might be possible to use a field within [@metadata] to avoid getting the field in es. Try replacing everything! with [@metadata][everything] and see if that works. ---
**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Post date:** [August 1, 2018, 9:57pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/3 "2018-08-01T21:57:47Z")
Not getting this to work. Tied using the same string format as my es output. output{ elasticsearch { hosts =\> "##.##.##.##:9200" sniffing =\> false manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } # End elasticsearch Event if I put this it doesn't interpret the value just prints the actual word metadata... blaa whatever message =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%" ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2018, 10:54pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/4 "2018-08-01T22:54:21Z")
Aren't you using a syslog output to write to the SIM? (Did you mean SEIM?) What does that output look like? ---
**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Post date:** [August 2, 2018, 12:48am UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/5 "2018-08-02T00:48:13Z")
Yea my lazy finger just abbreviated. At the moment ``` syslog { id => "OSSEC_SYSLOG" host => "#.#.#.#" port => 514 appname => "OSSEC" sourcehost => "###-########" message => "%{full_log}" } ``` Which works as extected but does not give me the full json line. Tried many varients of your example and this one expecting to see "filebeat-6.3.2" ``` message => "%{[@metadata][beat]}-%{[@metadata][version]}%" ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 2, 2018, 1:13am UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/6 "2018-08-02T01:13:44Z")
I do not think you understood my suggestion. I am saying that you convert the entire event to JSON, and insert that as an additional field on the event using ``` ruby { code => ' event.set("everything!", event.to_json) ' } ``` Then instead of sending %{message} to the syslog output, send the %{everything!} field. So instead of using ``` message => "%{[@metadata][beat]}-%{[@metadata][version]}%" ``` use this which inserts the entire event as a JSON string ``` message => "%{everything!}" ``` I wrote that incorrectly in the first posting. Left out the %{}. Sorry about that. BTW, what is full\_log? Is that a field you parsed out of the original message field? Also, this will result in your events in elasticsearch having a field called everything!, which doubles the volume of data going into es. I am saying that to avoid that you could try ``` ruby { code => ' event.set("[@metadata][everything]", event.to_json) ' } ``` and this for the syslog output ``` message => "%{[@metadata][everything]}" ``` but I am not in a position to test that that works. But I would expect that you would get the normal syslog format (see the source [here](https://github.com/logstash-plugins/logstash-output-syslog/blob/9107091ca3163e5df4f704f690b745bb7301a679/lib/logstash/outputs/syslog.rb#L167)) with the message part being the JSON string. ---
**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Post date:** [August 2, 2018, 1:22am UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/7 "2018-08-02T01:22:16Z")
Yea I figured that it may be a type-o Tried %{everything!} and got the word everything also many other variants. full\_log is a field that I selected from kibana. ``` Msg: Aug 02 01:18:48 ###-####### OSSEC[-]: %{everything!}\0x0a Msg: Aug 02 01:18:48 ###-####### OSSEC[-]: %{everything!}\0x0a ``` ---
**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Post date:** [August 2, 2018, 1:50am UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/8 "2018-08-02T01:50:50Z")
> [@Badger](#): > > %{[@metadata][everything]} "%{[@metadata][everything]}" ``` Msg: Aug 02 01:48:29 ###-####### OSSEC[-]: %{[@metadata][everything]}\0x0a Msg: Aug 02 01:48:32 ###-####### OSSEC[-]: %{[@metadata][everything]}\0x0a ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 2, 2018, 1:46pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/9 "2018-08-02T13:46:44Z")
If %{} does not do the substitution it suggests the field does not exist. If you do not use [@metadata] and put the field on the event do you see it in elasticsearch? ---
**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Post date:** [August 2, 2018, 2:39pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/10 "2018-08-02T14:39:00Z")
My logs are getting into elastic fine. I assumed based on your feedback %everything% was an internal representation in logstash for the whole line ? I got the full\_log field from looking at the json message in kibana and I can select one or more to put into the message output but nothing I can find that represents the entire message. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 2, 2018, 2:58pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/11 "2018-08-02T14:58:30Z")
Do you see the everything! event in elasticsearch? everything! is not a logstash thing. It is getting added to the event by this ruby filter. ``` ruby { code => ' event.set("everything!", event.to_json) ' } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 30, 2018, 2:58pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/12 "2018-08-30T14:58:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.