Send Logstash internal logs to Syslog

We're wanting to send Logstash's own logs to syslog instead of to a file unfortunately there is very little information about what the log configuration should look like for this approach. So far what we've come up with is the following

log4j.rootLogger=INFO, SYSLOG

log4j.appender.SYSLOG.layout.ConversionPattern=java %d{ISO8601}{GMT} %p %t %c %M - %m%n

However this does not seem to work. Does anybody know what the file needs to look like to have Logstash send its own logs to Syslog

In you can add this = syslog
appender.syslog.type = Syslog = localhost
appender.syslog.protocol = tcp
appender.syslog.port = 514

rootLogger.appenderRef.syslog.ref = syslog

more configuration parameters can be found here

The configs are very picky on trailing white space, especially after the "type" fields

Logstash 6.6 comes with Log4J 2.9.1 from September 2017, it should contain the optional RFC5424Layout, but I believe by default the SyslogLayout is used. Config examples from before 2016 don't seem to be working.

Your example comes from loggly's version of the syslog appender. If you're serious about using it, you should add their JAR to the Java classpath.

I'm not using the log4j syslogappender myself.

Awesome thanks for that. I will go test that now. What logger are you using to log to syslog?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.