Logstash syslog output: Weird message processing

Elastic Stack Logstash
1

Hey there!

I've been trying to send a part of my events to another syslog receiver for further processing.

I use the logstash-output-syslog plugin for this purpose.

This is my configuration:

> output {
> if "flow" in [tags] {
>   syslog {
>   host => ["127.0.0.1"]
>   port => 515
>   message => "from:%{[flow][src_addr]} to %{[flow][dst_addr]} src_addr_locality=%{[flow][src_addr_locality]} dst_addr_locality=%{[flow][dst_addr_locality]} dst_port=%{[flow][dst_port]}"
>           }
>     }
> }

All these fields definitely exist!

If I filter the logstash output via tcpdump I only get the following message:

<13>Nov 14 08:39:46 %{host} LOGSTASH[-]: 2019-11-14T08:39:46.976Z %{host} %{message}

Does anyone have a idea why the event contains the value "%{message}" and not the configured string ?

(I am using Logstash-OSS 7.3.1 and the latest syslog output plugin)

2

Change the part of message => "" to
codec => plain {
format => "from:%{[flow][src_addr]} to %{[flow][dst_addr]} src_addr_locality=%{[flow][src_addr_locality]} dst_addr_locality=%{[flow][dst_addr_locality]} dst_port=%{[flow][dst_port]}"
}

1 Like
3

You can also modify the source code of the logstash-output-syslog plugin to define it in whatever format you want.it‘s so easy.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.