@Makra
Originally I was not putting the PRI in the prefix of the message.
It seems to me that logstash-output-syslog should allow me to do that.
However, I changed the rsyslog.conf on the first box to include what gets pumped into logstash, as per your info.
I used tcpdump to verify the the proper prefix was included in what gets sent to logstash.
I used tcpdump to verify that the prefix was NOT included in what logstash pumps out.
I still go back to my original question.
Are you saying that logstash wont prefix the output unless it has it in the input?
Anyway, Now it is in the input and it still does not do it.
It seems to me that the logstash-output-syslog should allow a user to define the format of the output
and if you try to disect the source code, it implies that it does output data in rfc3164 format.
I'm just not knowledgable about the syntax of what it's really doing.
(PS this blog seems to screw up my typing when i try to put LESS-THAN-SIGN PRI GREATER-THAN-SIGN)