# Logstash syslog output

**URL:** <https://discuss.elastic.co/t/logstash-syslog-output/126605>\
**Category:** Logstash\
**Created:** [April 3, 2018, 4:08pm UTC](https://discuss.elastic.co/t/logstash-syslog-output/126605 "2018-04-03T16:08:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rxp1997](https://avatars.discourse-cdn.com/v4/letter/r/4491bb/32.png) [@rxp1997](https://discuss.elastic.co/u/rxp1997)\
**Post date:** [April 3, 2018, 4:08pm UTC](https://discuss.elastic.co/t/logstash-syslog-output/126605/1 "2018-04-03T16:08:32Z")

</div>

Hi, logstash newbie in need of advice

I am using logstash to ingest google pub/sub messages, which are single-line json messages, and want to forward them to a syslog server. Ingestion and writting the message to a file works fine.

my output stanza:  
syslog {  
host =\> "127.0.0.1"  
port =\> 514  
facility =\> "local0"  
severity =\> "informational"  
rfc =\> "rfc5424"  
appname =\> "stackdriver"  
sourcehost =\> "gcp"  
}

but syslog is ignoring facility and severity, and its not passing the message as the syslog msg.  
syslog debug shows PRI as 117 (logalert.notice), and the msg field is literally "%{message}"

Debugged syslog message:  
FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME: 'gcp', PRI: 117,  
syslogtag 'stackdriver', programname: 'stackdriver', APP-NAME: 'stackdriver', PROCID: '-', MSGID: '-',  
TIMESTAMP: 'Apr 3 15:53:53', STRUCTURED-DATA: '-',  
msg: '%{message}'  
escaped msg: '%{message}'  
inputname: imudp rawmsg: '\<117\>1 2018-04-03T15:53:53.456+00:00 gcp stackdriver - - - %{message}'

main concern is passing the JSON message as the syslog msg, PRI is secondary...

Thanks!!

Edit: This is complete config file  
input {  
google\_pubsub {  
project\_id =\> "bosh-concourse-2018"  
topic =\> "bosh-concourse-2018"  
subscription =\> "logstash-sub"  
json\_key\_file =\> "/usr/share/logstash/creds/pubsub.json"  
}  
}  
output {  
file {  
path =\> "/var/log/logstash/pubsub-output.log"  
flush\_interval =\> 0  
}  
syslog {  
host =\> "127.0.0.1"  
port =\> 514  
facility =\> "local0"  
severity =\> "informational"  
rfc =\> "rfc5424"  
appname =\> "stackdriver"  
sourcehost =\> "gcp"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 4:08pm UTC](https://discuss.elastic.co/t/logstash-syslog-output/126605/2 "2018-05-01T16:08:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.