Logstash-output-syslog plugin fix message and structured data

ZuperZero · September 24, 2021, 10:58am

So I tried to use the logstash-output-syslog plugin to send information to a syslog server.
I had multiple issues with messages containing all sorts of garbage (duplicate timestamp, duplicate message ID and host field??). I wanted to follow the RFC5424 but there is no support in the plugin for structured data, and a lot of other things. So I decided to do something about it. Even though there is two pull requests wanting to do something about the structured data, it haven't been implemented, and then there is still the issue about the message. I'm not really a ruby guy, but this should do.

github.com

ZuperSero/logstash-output-syslog/blob/master/lib/logstash/outputs/syslog.rb

# encoding: utf-8
require "logstash/outputs/base"
require "logstash/namespace"
require "date"
require "logstash/codecs/plain"

# Send events to a syslog server.
#
# You can send messages compliant with RFC3164 or RFC5424
# using either UDP or TCP as the transport protocol.
#
# By default the contents of the `message` field will be shipped as
# the free-form message text part of the emitted syslog message. If
# your messages don't have a `message` field or if you for some other
# reason want to change the emitted message, modify the `message`
# configuration option.
class LogStash::Outputs::Syslog < LogStash::Outputs::Base
  config_name "syslog"

  FACILITY_LABELS = [

This file has been truncated. show original

I have tested this in a docker setup and it works flawlessly, I'm going to be moving it to our internal testing in the near future.

For reference, setup is redhat with filebeat -> logstash -> syslog
here is the output before the fix.

<14>1 2021-09-24T08:42:21.850+00:00 redhatfilebeat tagged 43 69 69  2021-09-24T08:42:21.850Z {name=redhatfilebeat} this is a test

and after fix

<14>1 2021-09-24T09:22:23.411+00:00 redhatfilebeat tagged 58 69 [timeQuality tzKnown="1" isSynced="0"] this is a test

It would be awesome if this could be implemented into the plugin, or if anyone knows a better way to fix this I'm all ears

system · October 22, 2021, 10:59am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.