# Logstash-output-syslog full json in message?

**URL:** <https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642>\
**Category:** Logstash\
**Created:** [August 1, 2018, 7:02pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642 "2018-08-01T19:02:19Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 2, 2018, 1:13am UTC](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/6 "2018-08-02T01:13:44Z")

</div>

I do not think you understood my suggestion. I am saying that you convert the entire event to JSON, and insert that as an additional field on the event using

```
ruby { code => ' event.set("everything!", event.to_json) ' } 

```

Then instead of sending %{message} to the syslog output, send the %{everything!} field. So instead of using

```
message => "%{[@metadata][beat]}-%{[@metadata][version]}%"

```

use this which inserts the entire event as a JSON string

```
message => "%{everything!}"

```

I wrote that incorrectly in the first posting. Left out the %{}. Sorry about that.

BTW, what is full\_log? Is that a field you parsed out of the original message field?

Also, this will result in your events in elasticsearch having a field called everything!, which doubles the volume of data going into es. I am saying that to avoid that you could try

```
ruby { code => ' event.set("[@metadata][everything]", event.to_json) ' } 

```

and this for the syslog output

```
message => "%{[@metadata][everything]}"

```

but I am not in a position to test that that works. But I would expect that you would get the normal syslog format (see the source [here](https://github.com/logstash-plugins/logstash-output-syslog/blob/9107091ca3163e5df4f704f690b745bb7301a679/lib/logstash/outputs/syslog.rb#L167)) with the message part being the JSON string.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642)._