# Logstash - Syslog Output - Custom message
**URL:** https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979
**Category:** Logstash
**Created:** [July 13, 2020, 1:44pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979 "2020-07-13T13:44:16Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [July 13, 2020, 1:44pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/1 "2020-07-13T13:44:16Z")
Hi,
I'm working with Logstash - **Syslog Output** and I've found problem with custom field `message`. I'm using Elasticstack 7.8.0.
I've installed logstash **syslog-output** plugin.
```
/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog
```
Logstash configuration:
```
output {
syslog {
host => "localhost"
sourcehost => "logstash-other-as1"
port => 10514
protocol => "tcp"
message => "testing message"
#message => "%{custom-message}"
appname => "apptest"
}
}
```
I'm storing all received data to Elasticsearch DB to review them. Data (Document in Kibana) looks like:
`<13>Jul 13 13:41:11 logstash-other-as1 apptest[-]: 2020-07-13T13:41:11.000Z %{host} %{message}`
I was using the same configuration on ES stack 6.3.2 and it worked well.
**Does anyone know how to resolve this issue?**
---
### Author:  [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [July 20, 2020, 2:55pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/2 "2020-07-20T14:55:58Z")
Is it bug?
---
### Author:  [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [July 29, 2020, 8:36am UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/3 "2020-07-29T08:36:21Z")
I've done a workaround with logstash `plugins` split and `prune`.
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 29, 2020, 8:08pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/4 "2020-07-29T20:08:48Z")
Out of curiosity, why are you sending as "`syslog"` from `"logstash to elasticsearch"`? Can it be native output from logstash?
Or do you mean you accept `"syslog"` into logstash and then sent to elasticsearch? if that's the case, then it should be `"input"` at logstash
---
### Author:  [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [July 30, 2020, 5:20am UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/5 "2020-07-30T05:20:08Z")
I'm receiving events from Redis queue.
The messages are:
1. stored to ES for internal purposes (+ parsing, + enrichment of documents)
2. original (RAW) message (no parsing, no transformation) is sent to external syslog server to customer which requires this way
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 30, 2020, 8:24am UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/6 "2020-07-30T08:24:13Z")
ah.ok. So what you are saying is
- Redis queue -\> logstash -\> (output for) elasticsearch (`is Working?`)
- Redis queue -\> logstash -\> (output for) external syslog server (`NOT working?`)
---
### Author:  [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [July 30, 2020, 8:38am UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/7 "2020-07-30T08:38:29Z")
Both of them are working, but in second case (Redis - Logstash - Remote Syslog Server) was problem with defining custom message and host in `logstash-output-syslog plugin` which can be easily fixed by `split` and `prune` in filter section.
Logstash-output-syslog plugin must be installed using:
`/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog`
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 30, 2020, 2:37pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/8 "2020-07-30T14:37:23Z")
cheers for the clarification.
1. for the custom message is it by any chance STRUCTRED\_MSG?
2. What's ur template for collecting the syslog at syslog-server?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2020, 2:37pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979/9 "2020-08-27T14:37:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.