# Setting protocol type in Unix Input Plugin

**URL:** <https://discuss.elastic.co/t/setting-protocol-type-in-unix-input-plugin/127205>\
**Category:** Logstash\
**Created:** [April 8, 2018, 10:39am UTC](https://discuss.elastic.co/t/setting-protocol-type-in-unix-input-plugin/127205 "2018-04-08T10:39:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mibu](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mibu](https://discuss.elastic.co/u/mibu)\
**Post date:** [April 8, 2018, 10:39am UTC](https://discuss.elastic.co/t/setting-protocol-type-in-unix-input-plugin/127205/1 "2018-04-08T10:39:47Z")

</div>

Hello everybody,

I am trying to receive journald messages by forwarding them to syslog. My Linux is a systemd-system (OpenSUSE Leap 42.2) with no syslog daemon installed and I would like to avoid installing one.

The Syslog input plugin does not work because journald sends the messages to the unix domain socket /run/systemd/journal/syslog. So I am using the Unix input plugin.

For testing my pipeline is configured as follows:

input {  
unix {  
path =\> "/run/systemd/journal/syslog"  
force\_unlink =\> true  
mode =\> "server"  
}  
}

output {  
file {  
path =\> "/var/log/logstash/unix.log"  
}  
}

Testing the socket with 'nc -U /run/systemd/journal/syslog' works fine. Each entered line is dropped into unix.log. But no journald messages are received.

Then I checked was journald is doing with the socket by 'strace -p -yy -s 500 |& grep /run/systemd/journal/syslog'. The sendmsg call failed with "EPROTOTYPE (Protocol wrong type for socket)".

I guess that the protocol types used by journald and logstash are different. As I found out journald expects a datagram socket. With my netcat I cannot specify the protcol type for domain sockets but I suppose that the default is streaming and that the unix plugin creates a streaming socket.

I cannot find any setting for the protocol type in the unix input plugin. Maybe there there is a workaround?

Many thanks,  
Michael

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2018, 10:40am UTC](https://discuss.elastic.co/t/setting-protocol-type-in-unix-input-plugin/127205/2 "2018-05-06T10:40:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.