# RELP plugin does not parse syslogs

**URL:** https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365
**Category:** Logstash
**Created:** [August 18, 2022, 9:19am UTC](https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365 "2022-08-18T09:19:37Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Fastfox](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@Fastfox](https://discuss.elastic.co/u/Fastfox)
#### Post date: [August 18, 2022, 9:19am UTC](https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365/1 "2022-08-18T09:19:37Z")

</div>

Hi there,

Getting to know Elastic stack here and I noticed that normal TCP reliability is not enough for my usecase where the device will be powered off suddenly at at arbitrary times. It looks like rsyslog RELP protocol is the solution and logstash seems to have a plugin for that too.

But how is that supposed to be used? I first had "normal" syslog input, like:

```auto
input {
  syslog {
    type => syslog
    port => 9998
  }
}

```

and then I could use filter like this for example

```auto
filter { 
  if [program] == "temp_sensors" {
    grok {

```

But now when I installed relp plugin and say

```auto
input {
  relp {
    type => syslog
    id => relpinput1
    port => 9998
  }
}

```

filters do not match to anything and from elastic DB I can see that it has really parsed and found only the `message` field. Looks like the whole syslog metadata; program, priorities, facility etc. are not there

So the question is: How should I use the relp plugin so that logs are parsed like the syslog plugin does?

---

<div class="post-metadata">

### Author: ![Fastfox](https://avatars.discourse-cdn.com/v4/letter/f/b5a626/32.png) [@Fastfox](https://discuss.elastic.co/u/Fastfox)
#### Post date: [August 18, 2022, 11:35am UTC](https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365/2 "2022-08-18T11:35:22Z")

</div>

As a workaround I can add extra rsyslogd instance between the device and logstash. Like this:

```auto
module(load="imrelp")
input(type="imrelp" port="9998")

action(type="omfwd" target="logstash" port="9999" protocol="tcp" template="RSYSLOG_ForwardFormat")

```

Then rsyslog handles the reliability and logstash still manages to parse logs correctly.

But I am sure that there is proper solution to this out there.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 18, 2022, 4:51pm UTC](https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365/3 "2022-08-18T16:51:30Z")

</div>

> [@Fastfox](#):
>
> So the question is: How should I use the relp plugin so that logs are parsed like the syslog plugin does?

You can't. The relp plugin just [unpacks the frame](https://github.com/logstash-plugins/logstash-input-relp/blob/cc874e603221f33afe67fab49e506a1fbd0e3c34/lib/logstash/inputs/relp.rb#L105) and creates an event from it. The [syslog plugin](https://github.com/logstash-plugins/logstash-input-syslog/blob/7a544560fd7171105f27ffd66db7dc49b542345e/lib/logstash/inputs/syslog.rb#L326) runs a grok and a date filter and parses the priority string. The relp plugin simply does not do that.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 15, 2022, 4:52pm UTC](https://discuss.elastic.co/t/relp-plugin-does-not-parse-syslogs/312365/4 "2022-09-15T16:52:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.