# Syslog output plugin configuration **URL:** \ **Category:** Logstash\ **Created:** [July 27, 2015, 9:28pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368 "2015-07-27T21:28:00Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![kkomv](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kkomv](https://discuss.elastic.co/u/kkomv)\ **Post date:** [July 27, 2015, 9:28pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/1 "2015-07-27T21:28:00Z")
Please help in configuring sylog output plugin I keep getting the below error while starting logstash - TypeError: can't convert nil into String + at org/jruby/RubyString.java:1172 receive at /logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-output-syslog-0.1.4/lib/logstash/outputs/syslog.rb:127 handle at /logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/outputs/base.rb:88 output\_func at (eval):27 outputworker at /logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:243 start\_outputs at /logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:165 Below is the logstash conf file. input { redis { host =\> "127.0.0.1" port =\> "7999" data\_type =\> "list" key =\> "logstash" codec =\> json } } output { elasticsearch { cluster =\> "cluster" host =\> "127.0.0.1" port =\> "9200" protocol =\> "http" index =\> "logstash-%{+YYYY.MM.dd.HH}" } syslog{ host =\> "127.0.0.1" port =\> 514 facility =\> "local0" severity =\> "informational" appname =\> "LOGSTASH" procid =\> "123" msgid =\> "456" sourcehost =\> "localhost" } } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 27, 2015, 10:59pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/2 "2015-07-27T22:59:48Z")
`port => "514"` - change that and try again. ---
**Author:** ![kkomv](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kkomv](https://discuss.elastic.co/u/kkomv)\ **Post date:** [July 28, 2015, 12:43am UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/3 "2015-07-28T00:43:43Z")
It still shows me the same error ,event after enclosing the port number in "". Not sure what other configuration is missing here. ---
**Author:** ![suyograo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suyograo/32/44898_2.png) [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Post date:** [July 28, 2015, 6:03am UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/4 "2015-07-28T06:03:35Z")
@kkomv thats weird, you seem to have all the configs right. Can you remove the redis input and try with a stdin input and enter a message? basically: ```auto input { stdin { } } ouptut { syslog{ host => "127.0.0.1" port => 514 facility => "local0" severity => "informational" appname => "LOGSTASH" procid => "123" msgid => "456" sourcehost => "localhost" } } ``` ---
**Author:** ![mberger](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mberger](https://discuss.elastic.co/u/mberger)\ **Post date:** [July 31, 2015, 10:26am UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/5 "2015-07-31T10:26:17Z")
Hi, I am having the same problem using the syslog-output plugin. Logstash is collection syslog-messages from a lot of servers and I'd like to forward some lines to another one. ``` output { elasticsearch { host => localhost } if [type] == "syslog" and "_grokparsefailure" in [tags] { file { path => "/var/log/logstash/syslog_failed_events-%{+YYYY-MM-dd}" } } if [type] == "syslog" and "exim" in [syslog_program] { file { path => "/tmp/exim-out-%{+YYYY-MM-dd}" } syslog { facility => "mail" severity => "informational" host => "212.33.32.231" port => 514 } } } ``` The file output works fine and looks like this: ``` {"@version":"1","@timestamp":"2015-07-31T10:06:18.000Z","host":"192.168.224.32","type":"syslog","syslog_pri":"22","syslog_timestamp":"Jul 31 12:06:18","syslog_hostname":"so03","syslog_program":"exim","syslog_pid":"25317","syslog_message":"2015-07-31 12:06:18 TLS error on connection from [192.168.224.241] (SSL_accept): error:00000000:lib(0):func(0):reason(0)","tags":["Syslog","TS","exim error"],"received_at":"2015-07-31T10:06:18.000Z","syslog_severity_code":6,"syslog_facility_code":2,"syslog_facility":"mail","syslog_severity":"informational","exim_tlserror":"on connection from [192.168.224.241] (SSL_accept): error:00000000:lib(0):func(0):reason(0)"} ``` Since the error is in line 128 I am wondering if there is something wrong with the conversion of "priority" to string?! ``` TypeError: can't convert nil into String + at org/jruby/RubyString.java:1172 receive at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-syslog-0.1.4/lib/logstash/outputs/syslog.rb:128 handle at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/outputs/base.rb:88 output_func at (eval):416 outputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:244 start_outputs at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:166 ``` Thanks for your help! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 31, 2015, 2:55pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/6 "2015-07-31T14:55:43Z")
Your message is missing a `message` field and the syslog output requires it to be present. This is however not documented and the error mode when the field is missing is obviously less than perfect. I've filed [issue #11](https://github.com/logstash-plugins/logstash-output-syslog/issues/11) to improve this. I noted that someone else was bitten by the exact same thing earlier today ([issue #10](https://github.com/logstash-plugins/logstash-output-syslog/issues/10)). Perhaps you can simply rename your `syslog_message` field to `message`? ---
**Author:** ![kkomv](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kkomv](https://discuss.elastic.co/u/kkomv)\ **Post date:** [July 31, 2015, 7:02pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/7 "2015-07-31T19:02:37Z")
Thanks @magnusbaeck , it's now working once I added the _message_ field. ---
**Author:** ![mberger](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mberger](https://discuss.elastic.co/u/mberger)\ **Post date:** [August 3, 2015, 8:33am UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/8 "2015-08-03T08:33:43Z")
Thanks @magnusbaeck , my setup is now working as well! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368/9 "2017-07-06T05:33:05Z")