# Send Logstash internal logs to Syslog

**URL:** <https://discuss.elastic.co/t/send-logstash-internal-logs-to-syslog/169299>\
**Category:** Logstash\
**Created:** [February 20, 2019, 10:35pm UTC](https://discuss.elastic.co/t/send-logstash-internal-logs-to-syslog/169299 "2019-02-20T22:35:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![petrik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petrik/32/21629_2.png) [@petrik](https://discuss.elastic.co/u/petrik)\
**Post date:** [February 20, 2019, 10:35pm UTC](https://discuss.elastic.co/t/send-logstash-internal-logs-to-syslog/169299/1 "2019-02-20T22:35:12Z")

</div>

We're wanting to send Logstash's own logs to syslog instead of to a file unfortunately there is very little information about what the log configuration should look like for this approach. So far what we've come up with is the following

```
log4j.rootLogger=INFO, SYSLOG

log4j.appender.SYSLOG=com.github.loggly.log4j.SyslogAppender64k
log4j.appender.SYSLOG.SyslogHost=localhost
log4j.appender.SYSLOG.Facility=Local0
log4j.appender.SYSLOG.Header=true
log4j.appender.SYSLOG.layout=org.apache.log4j.EnhancedPatternLayout
log4j.appender.SYSLOG.layout.ConversionPattern=java %d{ISO8601}{GMT} %p %t %c %M - %m%n

```

However this does not seem to work. Does anybody know what the log4j2.properties file needs to look like to have Logstash send its own logs to Syslog

---

<div class="post-metadata">

**Author:** ![janmg](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@janmg](https://discuss.elastic.co/u/janmg)\
**Post date:** [February 25, 2019, 1:08pm UTC](https://discuss.elastic.co/t/send-logstash-internal-logs-to-syslog/169299/2 "2019-02-25T13:08:21Z")

</div>

In log4j.properties you can add this

```auto
appender.syslog.name = syslog
appender.syslog.type = Syslog
appender.syslog.host = localhost
appender.syslog.protocol = tcp
appender.syslog.port = 514

rootLogger.appenderRef.syslog.ref = syslog

```

more configuration parameters can be found here  
[https://logging.apache.org/log4j/log4j-2.7/manual/appenders.html#SyslogAppender](https://logging.apache.org/log4j/log4j-2.7/manual/appenders.html#SyslogAppender)

The configs are very picky on trailing white space, especially after the "type" fields

Logstash 6.6 comes with Log4J 2.9.1 from September 2017, it should contain the optional RFC5424Layout, but I believe by default the SyslogLayout is used. Config examples from before 2016 don't seem to be working.  
[https://issues.apache.org/jira/browse/LOG4J2-969](https://issues.apache.org/jira/browse/LOG4J2-969)

Your example comes from loggly's version of the syslog appender. If you're serious about using it, you should add their JAR to the Java classpath.

I'm not using the log4j syslogappender myself.

---

<div class="post-metadata">

**Author:** ![petrik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petrik/32/21629_2.png) [@petrik](https://discuss.elastic.co/u/petrik)\
**Post date:** [February 25, 2019, 7:00pm UTC](https://discuss.elastic.co/t/send-logstash-internal-logs-to-syslog/169299/3 "2019-02-25T19:00:41Z")

</div>

Awesome thanks for that. I will go test that now. What logger are you using to log to syslog?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2019, 7:00pm UTC](https://discuss.elastic.co/t/send-logstash-internal-logs-to-syslog/169299/4 "2019-03-25T19:00:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.