# Logstash's own log conf - log4j with syslog appender

**URL:** <https://discuss.elastic.co/t/logstashs-own-log-conf-log4j-with-syslog-appender/93715>\
**Category:** Logstash\
**Created:** [July 19, 2017, 8:09am UTC](https://discuss.elastic.co/t/logstashs-own-log-conf-log4j-with-syslog-appender/93715 "2017-07-19T08:09:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![randude](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/randude/32/34911_2.png) [@randude](https://discuss.elastic.co/u/randude)\
**Post date:** [July 19, 2017, 8:09am UTC](https://discuss.elastic.co/t/logstashs-own-log-conf-log4j-with-syslog-appender/93715/1 "2017-07-19T08:09:51Z")

</div>

Hi,  
I'm trying to send Logstash's own log to my rsyslog process. I'm using the conf below.  
Logstash does indeed send log data to my rsyslog process but it uses default settings and basically just ignores my custom settings. I've googled all other the place and I just cant get it to work properly.  
I'm using ubuntu 16.

Any help with configuring the log to output only INFO and above in my custom log format is welcomed.

Here are my settings:

log4j.rootLogger= syslog #this causes logstash to output to syslog

# these dont seem to work at all

log4j.appender.syslog=org.apache.log4j.net.SyslogAppender  
log4j.appender.syslog.threshold=INFO  
log4j.appender.syslog.syslogHost=localhost  
log4j.appender.syslog.facility=LOCAL6  
log4j.appender.syslog.layout=org.apache.log4j.PatternLayout  
log4j.appender.syslog.layout.conversionPattern=%d{MMM dd HH:mm:ss} logstash %p %m%n

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2017, 8:10am UTC](https://discuss.elastic.co/t/logstashs-own-log-conf-log4j-with-syslog-appender/93715/2 "2017-08-16T08:10:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
