# Syslog input plugin from Logstash, how to configure in Elastic agent? **URL:** \ **Category:** Logstash\ **Tags:** fleet\ **Created:** [August 21, 2023, 8:29pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300 "2023-08-21T20:29:30Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 21, 2023, 8:29pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/1 "2023-08-21T20:29:30Z")
I have about 2000 Elastic agents (version 8.9.0) connected to a system with 3 Fleet servers (version 8.9.0). We have about 20 different agent policies, because the various Elastic agents are sending slightly different logs, and for certain cases we need to specify specific pipelines to process the logs. Is it possible to configure the [syslog input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html) using the elastic agent policy? Or do I need to configure [syslog input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html) in a different way? I have only configured elastic agent, and never configured logstash directly. ---
**Author:** ![Julia\_Bardi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julia_bardi/32/79463_2.png) [@Julia\_Bardi](https://discuss.elastic.co/u/Julia_Bardi)\ **Post date:** [August 22, 2023, 11:00am UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/2 "2023-08-22T11:00:58Z")
Hi Craig, Logstash input plugins can't be configured in an Elastic Agent policy. You need to configure in the usual ways, editing Logstash's [pipeline files](https://www.elastic.co/guide/en/logstash/8.9/configuration.html), ( `.conf` ) or if you have xpack you can use [Central Pipeline Management](https://www.elastic.co/guide/en/logstash/8.9/logstash-centralized-pipeline-management.html) from Kibana. ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 22, 2023, 11:24am UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/3 "2023-08-22T11:24:26Z")
I noticed this page was recently added: > **[Syslog | Fleet and Elastic Agent Guide \[8.9\] | Elastic](https://www.elastic.co/guide/en/fleet/current/syslog-processor.html)** Does this mean that: ```auto - syslog: field: message ``` can be added to the `processor` section of an Elastic Agent policy to send data via syslog? ---
**Author:** ![Julia\_Bardi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julia_bardi/32/79463_2.png) [@Julia\_Bardi](https://discuss.elastic.co/u/Julia_Bardi)\ **Post date:** [August 22, 2023, 11:31am UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/4 "2023-08-22T11:31:15Z")
Yes, it looks like a new processor that can be added to an agent policy. ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 22, 2023, 11:54am UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/5 "2023-08-22T11:54:42Z")
It looks like this was added to beats last year in [https://github.com/elastic/beats/pull/30541](https://github.com/elastic/beats/pull/30541) by @taylor-swanson . What advantage does using this processor in the elastic-agent/beats offer? I am investigating if it is possible to send syslog data from a host directly to elasticsearch without running elastic-agent/beats on an end host. In earlier versions of elastic-agent (version 8.4.2), for scenarios with very high load scenarios, the elastic-agent would become unresponsize with zombie processes. Maybe this is improved in elastic-agent (version 8.9.1)? For my use-case, I don't see a lot of value in the syslog processor, because I still need to run the elastic-agent on the end host. Am I understanding this correctly, or is there something that I am not understanding properly? Thanks. ---
**Author:** ![taylor-swanson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taylor-swanson/32/100638_2.png) [@taylor-swanson](https://discuss.elastic.co/u/taylor-swanson)\ **Post date:** [August 22, 2023, 12:45pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/6 "2023-08-22T12:45:01Z")
Hi Craig, The syslog processor detaches the syslog parsing functionality from whatever Filebeat input is being used. Prior to this, only the syslog input was available, which meant you were forced to use either TCP, UDP, or a unix socket as means for consuming syslog messages. Now that the syslog processor is available, any input can be used, it is only a matter of passing the syslog message data to the processor. This does mean that you must still use either Elastic Agent or Filebeat if you want to use this particular syslog processor. ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 24, 2023, 10:56am UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/7 "2023-08-24T10:56:53Z")
Taylor, Does the [syslog-processor](https://www.elastic.co/guide/en/fleet/current/syslog-processor.html) accept syslog input from over TCP, UDP, unix domain socket? Would this be done through elastic-agent? I would like to send messages from syslogd, and then use this processor to ship the messages to Elastic. It's not clear to me from the documentation for this processor where the input comes from. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 24, 2023, 12:37pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/8 "2023-08-24T12:37:32Z")
In the [documentation](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) you have this information. > Elastic Agent processors are lightweight processing components that you can use to parse, filter, transform, and enrich data at the **source**. And also this [one](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html#where-valid) that tells where you configure the processor. The processor does not exist alone, it is part of some integration and is executed on the elastic agent that is running that integration. For example, If you want to receive syslog data using TCP, then you will need to create a Custom TCP logs integrations and configure the syslog-processor in this integration. ---
**Author:** ![taylor-swanson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taylor-swanson/32/100638_2.png) [@taylor-swanson](https://discuss.elastic.co/u/taylor-swanson)\ **Post date:** [August 24, 2023, 1:48pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/9 "2023-08-24T13:48:25Z")
The syslog processor itself doesn't handle external input. A filebeat input would sit in front of the chain and would read in syslog messages from some source (tcp, udp, file, etc) and would then pass it to the syslog processor. As Leandro mentioned, in the context of Elastic Agent, the input/processor chain will be part of an existing integration such as the Custom TCP or Custom UDP logs integration, syslog parsing just needs to be enabled when configuring the integration. ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 24, 2023, 8:22pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/10 "2023-08-24T20:22:01Z")
Leandro and Taylor, Thanks for your replies. The information you have provided is accurate and very useful! For the syslog processor, would it be OK to add some explanation in: > **[Syslog | Fleet and Elastic Agent Guide \[8.9\] | Elastic](https://www.elastic.co/guide/en/fleet/current/syslog-processor.html)** with what you have mentioned, and cross reference things like filebeat input, Custom TCP or Custom UDP logs integration? I can even take a whack at submitting a docs PR to that page of what I think clarifies the concepts for me, and that PR can be evaluated/refined with feedback. ---
**Author:** ![taylor-swanson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taylor-swanson/32/100638_2.png) [@taylor-swanson](https://discuss.elastic.co/u/taylor-swanson)\ **Post date:** [August 25, 2023, 1:31pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/11 "2023-08-25T13:31:29Z")
We can certainly add additional context to the documentation. I'll write up an issue to track that work (we are also going to be removing the "experimental" flag from the processor as part of that change). You can track the work being done here: [Remove experimental tag from syslog processor and improve documentation · Issue #36416 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/36416) I'll try to get a PR up for that soon (link for the PR will appear in the issue linked above). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 22, 2023, 1:31pm UTC](https://discuss.elastic.co/t/syslog-input-plugin-from-logstash-how-to-configure-in-elastic-agent/341300/12 "2023-09-22T13:31:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.