# Syslog output doesn't support dynamic host **URL:** \ **Category:** Logstash\ **Created:** [September 4, 2017, 7:55am UTC](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257 "2017-09-04T07:55:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [September 4, 2017, 7:55am UTC](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257/1 "2017-09-04T07:55:56Z")
Hi, I have to route alerts from remote sites back to their syslog servers. For that, I parse the alert event and based on its' value, I add metadata field: `if [_source][site] == "new york" { mutate { add_field => { "[@metadata][remotesite]" => "ny.remote.site" } } }` I have verified with rubydebug that this will generate the metadata field correctly: `{ "@timestamp" => 2017-09-04T07:17:09.152Z, "_index" => "company-sonicwall-2017.09.04", "@metadata" => { "remotesite" => "ny.remote.site", "appname" => "SonicwallFailedLogin" }, "_type" => "sonicwall", "_source" => { ..... REMOVED ...... }, "_id" => "sdfjksdhlkrh32we", "_score" => 1.0, "type" => "alarm" }` I have configured syslog output like this: `syslog { appname => "%{[@metadata][appname]}" host => "%{[@metadata][remotesite]}" message => "Login alert etc." port => 514 priority => "<129>" protocol => "tcp" rfc => "rfc5424" severity => "alarm" sourcehost => "%{[_source][host]}" } }` I get this error when it tries to send the event to syslog server: `[2017-09-04T10:39:38,017][WARN][logstash.outputs.syslog] syslog tcp output exception: closing, reconnecting and resending event {:host=>"%{[@metadata][remotesite]}", :port=>514, :exception=>#, :backtrace=>["org/jruby/ext/socket/RubyTCPSocket.java:129:in`initialize'", "org/jruby/RubyIO.java:871:in `new'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-syslog-3.0.2/lib/logstash/outputs/syslog.rb:210:in`connect'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-syslog-3.0.2/lib/logstash/outputs/syslog.rb:178:in `publish'", "org/jruby/RubyProc.java:281:in`call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-plain-3.0.3/lib/logstash/codecs/plain.rb:41:in `encode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-syslog-3.0.2/lib/logstash/outputs/syslog.rb:147:in`receive'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in `multi_receive'", "org/jruby/RubyArray.java:1613:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/legacy.rb:22:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator.rb:47:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:420:in`output\_batch'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:419:in`output\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:365:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:330:in`start\_workers'"], :event=\>2017-09-04T07:39:27.906Z %{host} %{message}}` So it seems that the host field doesn't support dynamic field-value replacement? I have verified that the sending host can reach the remote syslog server and the domain name resolves correctly. Any ideas? ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [September 7, 2017, 4:20pm UTC](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257/2 "2017-09-07T16:20:42Z")
You suspect correctly, the syslog output does not support dynamic fields. Your only option is to use an if block in the output section to steer the event to one of many hard coded `host` outputs. ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [September 8, 2017, 6:42am UTC](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257/3 "2017-09-08T06:42:37Z")
Thank you for your reply @guyboertje. Yeah, that's what I am doing currently, but we are expecting to get a lot more remote sites, so it is not feasible solution in a long run. What are my options here, I mean is it community supported plugin, should I post this in github issues, is it a real issue to use dynamic field as a host or just a design decision or ? ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [September 8, 2017, 1:24pm UTC](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257/4 "2017-09-08T13:24:58Z")
In the current code, the connection is made once for the `@host` and reused. To properly implement a dynamic solution the code would need to cache the connection in a LRU cache with a disconnect on cache eviction. There may be a security issue as well with dynamic host names. This may be lessened if we only allow the variable portion to come from a `@metadata` field. It is unlikely that we will make this change in the near term. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 6, 2017, 1:25pm UTC](https://discuss.elastic.co/t/syslog-output-doesnt-support-dynamic-host/99257/5 "2017-10-06T13:25:53Z")
Closed on October 6, 2017, 1:25pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.