# Logstash - Syslog Output - Custom message

**URL:** https://discuss.elastic.co/t/logstash-syslog-output-custom-message/333588
**Category:** Logstash
**Created:** [May 16, 2023, 4:18pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/333588 "2023-05-16T16:18:03Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Nandhini\_Viswanathan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nandhini_viswanathan/32/121085_2.png) [@Nandhini\_Viswanathan](https://discuss.elastic.co/u/Nandhini_Viswanathan)
#### Post date: [May 16, 2023, 4:18pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/333588/1 "2023-05-16T16:18:03Z")

</div>

Logstash - Syslog Output - Custom message

Hi,  
I'm ~~I~~ working with Logstash - **Syslog Output** and I've found ~~out~~ problem with ~~setting~~ custom field `message`. I'm using Elasticstack 7.8.0.

I've installed logstash **syslog-output** plugin.

```auto
/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog

```

Logstash configuration:

```auto
 output {
    syslog {
        host => "localhost"
        sourcehost => "logstash-other-as1"
        port => 10514
        protocol => "tcp"
        message => "testing message"
        #message => "%{custom-message}"
        appname => "apptest"
      }
}

```

I'm storing all received data to Elasticsearch DB to review them. Data (Document in Kibana) looks like:

`<13>Jul 13 13:41:11 logstash-other-as1 apptestopttest[-]: 2020-07-13T13:41:11.000Z %{host} %{message}`

I was using the same configuration on ES stack 6.3.2 and it worked well ~~worked~~.  
**Does anyone know how to resolve this issue?**

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 13, 2023, 4:18pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/333588/2 "2023-06-13T16:18:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
