# Syslog Output only transferring the "message" field

**URL:** <https://discuss.elastic.co/t/syslog-output-only-transferring-the-message-field/353396>\
**Category:** Logstash\
**Created:** [February 15, 2024, 4:27pm UTC](https://discuss.elastic.co/t/syslog-output-only-transferring-the-message-field/353396 "2024-02-15T16:27:17Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 16, 2024, 1:15pm UTC](https://discuss.elastic.co/t/syslog-output-only-transferring-the-message-field/353396/8 "2024-02-16T13:15:03Z")

</div>

You could use a Ruby filter to parse the entire event as json (or key=value) into a field and then use the message field on the syslog output to use the json field you created as the content. On the receiving side you'd parse the json back into a message.

See [Logstash-output-syslog full json in message? - #6 by Badger](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/6)

---

_[View the full topic](https://discuss.elastic.co/t/syslog-output-only-transferring-the-message-field/353396)._