# logstash syslog output json 부분 질문입니다

**URL:** <https://discuss.elastic.co/t/logstash-syslog-output-json/149182>\
**Category:** 한국어 질문 및 토론\
**Created:** [September 19, 2018, 7:07pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-json/149182 "2018-09-19T19:07:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![a1b0ddd1cbe847e64476](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@a1b0ddd1cbe847e64476](https://discuss.elastic.co/u/a1b0ddd1cbe847e64476)\
**Post date:** [September 19, 2018, 7:07pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-json/149182/1 "2018-09-19T19:07:59Z")

</div>

회사에 이용하기 위해 노력중입니다. 그 중에 버그인지 환경을 잘못 구성해서인지 이상하게 있습니다.

filebeat --\> logstash --\> syslog 서버에 수신된 메세지중에 'sourcehost' 필드 부분이 json 형태로 보입니다.

다른 메세지는 정상으로 보이는데, sourcehost 부분만 이상하게 나와서 문의드립니다.

- 사용중인 버전: filebeat/logstash (6.4.0)
- syslog 수신: syslog-ng (3.7)

logstash (rubydebug)

> {  
> "input" =\> {  
> "type" =\> "log"  
> },  
> "@timestamp" =\> 2018-09-19T07:14:19.019Z,  
> "offset" =\> 9477710,  
> "@metadata" =\> {  
> "beat" =\> "filebeat",  
> "type" =\> "doc",  
> "ip\_address" =\> "1.1.1.1",  
> "version" =\> "6.4.0"  
> },  
> "host" =\> {  
> `"name" => "1.1.1.1"`  
> },  
> "beat" =\> {  
> "hostname" =\> "HTTP\_RCG-2",  
> "name" =\> "HTTP\_RCG-2",  
> "version" =\> "6.4.0"  
> },  
> "prospector" =\> {  
> "type" =\> "log"  
> },  
> "message" =\> "[7035] : 2018-09-19 16:14:17.402 : {call P\_PROC\_REQ(?,?,?,?,?,?,?,?,?,?,?,?,?)} - IP : 1.1.1.1, O\_RET\_CD\t : 0001  
> "fields" =\> {  
> "app\_name" =\> "p\_daemon",  
> "app\_logtype" =\> "log",  
> "app\_id" =\> 1000  
> }  
> }

syslog 서버 (수신된 메세지)

> Sep 19 16:14:19 1.1.1.2 `{"name":"1.1.1.1"}` p\_daemon[1000]: [7035] : 2018-09-19 16:14:17.402 : {call P\_PROC\_REQ(?,?,?,?,?,?,?,?,?,?,?,?,?)} - IP : 1.1.1.1, O\_RET\_CD : 0001

logstash config

> input {  
> beats{  
> port =\> 5044  
> }  
> }
> 
> filter {  
> if [fields][app\_logtype] == "log" {  
> mutate {  
> # Remove junk data  
> remove\_field =\> ["@version","source","tags"]  
> # syslog hostname --\> IP  
> replace =\> { "[host][name]" =\> "%{[@metadata][ip\_address]}" }  
> }  
> } else {  
> drop { }  
> }  
> }
> 
> output {  
> syslog {  
> host =\> "1.1.1.3"  
> port =\> 515
> 
> ```
> # filebeat (app_name) --> syslog (appname)
> appname => "%{[fields][app_name]}"
> # filebeat (app_id) --> syslog (procid)
> procid => "%{[fields][app_id]}"
> }
> 
> stdout {
> codec => rubydebug {
> metadata => true
> }
> }
> 
> ```
> 
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2018, 7:08pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-json/149182/2 "2018-10-17T19:08:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.