# Sending and Filtering Logs to Syslog Server

**URL:** <https://discuss.elastic.co/t/sending-and-filtering-logs-to-syslog-server/375100>\
**Category:** Logstash\
**Created:** [February 26, 2025, 2:47pm UTC](https://discuss.elastic.co/t/sending-and-filtering-logs-to-syslog-server/375100 "2025-02-26T14:47:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kleioemre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kleioemre/32/140692_2.png) [@kleioemre](https://discuss.elastic.co/u/kleioemre)\
**Post date:** [February 26, 2025, 2:47pm UTC](https://discuss.elastic.co/t/sending-and-filtering-logs-to-syslog-server/375100/1 "2025-02-26T14:47:12Z")

</div>

Hi,  
I'm trying send logs to syslog server using output plugin but couldn't get any success. I want to send only certain pod logs and add the labels. Is this config accurate?

```auto
output {
  if [kubernetes][pod][name] =~ /^prod/ {
    syslog {
       host => "syslog server"
       port => 514
       protocol => "tcp"
       rfc => "rfc5424"
	   message => "Pod: %{[kubernetes][pod][name]}, Container: %{[kubernetes][container][name]}, Node: %{[kubernetes][node][name]}, Message: %{message}"
		}
	}
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 26, 2025, 3:54pm UTC](https://discuss.elastic.co/t/sending-and-filtering-logs-to-syslog-server/375100/2 "2025-02-26T15:54:29Z")

</div>

It looks reasonable. What isn't working? What appears in the logstash logs?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 26, 2025, 4:41pm UTC](https://discuss.elastic.co/t/sending-and-filtering-logs-to-syslog-server/375100/3 "2025-02-26T16:41:11Z")

</div>

Also check the value `[kubernetes][pod][name]`, does it start with "prod"