# Not capturing syslog output \[SOLVED\] **URL:** \ **Category:** Logstash\ **Created:** [July 5, 2016, 1:10pm UTC](https://discuss.elastic.co/t/not-capturing-syslog-output-solved/54735 "2016-07-05T13:10:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Post date:** [July 5, 2016, 1:10pm UTC](https://discuss.elastic.co/t/not-capturing-syslog-output-solved/54735/1 "2016-07-05T13:10:17Z")
Hello, all. I have the latest ELK components installed on a CentOS 6 server, and running well. I'm currently capturing Windows logs, and CentOS 6 and 7 logs via Filebeat. However, I have a number of CentOS 5 boxes on which I'm unable to install Filebeat (know issue), so I have to rely on natively forwarding syslog output via the following line in syslog.conf: _._ @10.0.101.101:1514 Alas, I'm not capturing any logs. I've tried everything I can thing of to make this work (checking firewall setting, etc.). I can ping the ELK server, as well as telnet to port 1514. The only other thing I can think of is that my configs are wrong, and, so, am asking your help. I've posted my config files here: [http://pastebin.com/qC3pdLRe](http://pastebin.com/qC3pdLRe) Many thanks. Diggy ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 5, 2016, 10:28pm UTC](https://discuss.elastic.co/t/not-capturing-syslog-output-solved/54735/2 "2016-07-05T22:28:08Z")
Does it work if you have a simple input\>output? ---
**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Post date:** [July 6, 2016, 1:04pm UTC](https://discuss.elastic.co/t/not-capturing-syslog-output-solved/54735/3 "2016-07-06T13:04:08Z")
Hi, Mark. I haven't, as I don't want to mess up everything else that's working. I know that's wimpy, but I hope someone can see some misconfiguration that I'm not. Another set of eyes on my configs would be appreciated. Diggy ---
**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Post date:** [July 7, 2016, 1:20pm UTC](https://discuss.elastic.co/t/not-capturing-syslog-output-solved/54735/4 "2016-07-07T13:20:35Z")
I've read a post or two suggesting alternatives to Filebeat for CentOS 5, namely Beaver and Nxlog (which I have running on my Windows servers, btw). Alas, the installation of these programs is a major pain, what with all of the dependencies required, some of which aren't available for the platform. That leads me back to having to make Logstash work with syslog on CentOS 5. Any help would be greatly appreciated. Diggy ---
**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Post date:** [July 7, 2016, 3:32pm UTC](https://discuss.elastic.co/t/not-capturing-syslog-output-solved/54735/5 "2016-07-07T15:32:52Z")
As per the suggestion in another post, I installed rsyslog on my CentOS 5 boxes, and logs are now flowing into Logstash. Too easy, but I wonder what makes rsyslog work, and not syslog. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/not-capturing-syslog-output-solved/54735/6 "2017-07-06T04:49:05Z")
Closed on July 6, 2017, 4:49am UTC