Logstash syslog output: Weird message processing

[froto (Toni Frommknecht)]

Hey there!

I've been trying to send a part of my events to another syslog receiver for further processing.

I use the logstash-output-syslog plugin for this purpose.

This is my configuration:

> output {
> if "flow" in [tags] {
>   syslog {
>   host => ["127.0.0.1"]
>   port => 515
>   message => "from:%{[flow][src_addr]} to %{[flow][dst_addr]} src_addr_locality=%{[flow][src_addr_locality]} dst_addr_locality=%{[flow][dst_addr_locality]} dst_port=%{[flow][dst_port]}"
>           }
>     }
> }

All these fields definitely exist!

If I filter the logstash output via tcpdump I only get the following message:

<13>Nov 14 08:39:46 %{host} LOGSTASH[-]: 2019-11-14T08:39:46.976Z %{host} %{message}

Does anyone have a idea why the event contains the value "%{message}" and not the configured string ?

(I am using Logstash-OSS 7.3.1 and the latest syslog output plugin)

[iridescent233]

Change the part of message => "" to
codec => plain {
format => "from:%{[flow][src_addr]} to %{[flow][dst_addr]} src_addr_locality=%{[flow][src_addr_locality]} dst_addr_locality=%{[flow][dst_addr_locality]} dst_port=%{[flow][dst_port]}"
}

[iridescent233]

You can also modify the source code of the logstash-output-syslog plugin to define it in whatever format you want.it‘s so easy.