# Syslog output plugin message parameter ignored

**URL:** <https://discuss.elastic.co/t/syslog-output-plugin-message-parameter-ignored/352560>\
**Category:** Logstash\
**Created:** [February 5, 2024, 6:09pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-message-parameter-ignored/352560 "2024-02-05T18:09:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mutt13y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mutt13y/32/74962_2.png) [@mutt13y](https://discuss.elastic.co/u/mutt13y)\
**Post date:** [February 5, 2024, 6:09pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-message-parameter-ignored/352560/1 "2024-02-05T18:09:41Z")

</div>

the message parameter for the syslog output plugin is documented as used to set the syslog message (default "%{message}")

The parameter is defined here [logstash-output-syslog/lib/logstash/outputs/syslog.rb at main · logstash-plugins/logstash-output-syslog · GitHub](https://github.com/logstash-plugins/logstash-output-syslog/blob/main/lib/logstash/outputs/syslog.rb#L127)

but it is never used in the plugin instead the message is constructed form the payload [logstash-output-syslog/lib/logstash/outputs/syslog.rb at main · logstash-plugins/logstash-output-syslog · GitHub](https://github.com/logstash-plugins/logstash-output-syslog/blob/main/lib/logstash/outputs/syslog.rb#L171)

if I configure as follows

```auto
syslog {
    host => "172.16.0.1"
    port => 514
    protocol => "tcp"
    msgid => "logstash"
    procid => "%{[log][syslog][msgid]}"
    facility => "%{[log][syslog][facility][name]}"
    priority => "%{[log][syslog][priority][name]}"
    sourcehost => "%{[log][hostname]}"
    message => " ___A___"
  }

```

the output message is simply constructed from the event message

Something like

```auto
message = event.sprintf(@message)
if message.nil?
   message = payload.to_s.rstrip.gsub(/[\r][\n]/, "\n").gsub(/[\n]/, '\n')
end

```

and setting the default value of message to nil should do the job and somewhat preserve compatibility

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 5, 2024, 8:05pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-message-parameter-ignored/352560/2 "2024-02-05T20:05:34Z")

</div>

> [@mutt13y](#):
>
> The parameter is defined here [here](https://github.com/logstash-plugins/logstash-output-syslog/blob/main/lib/logstash/outputs/syslog.rb#L127) but it is never used in the plugin

Not so. It is referenced [here](https://github.com/logstash-plugins/logstash-output-syslog/blob/f2cdc0bf39ab07d37c243ce411c7510b81c707a1/lib/logstash/outputs/syslog.rb#L148). plain is the default codec in the [base output](https://github.com/elastic/logstash/blob/fedcf58c4888c959ce1f7f7e6cec3b457fd16eb8/logstash-core/lib/logstash/outputs/base.rb#L35).

---

<div class="post-metadata">

**Author:** ![mutt13y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mutt13y/32/74962_2.png) [@mutt13y](https://discuss.elastic.co/u/mutt13y)\
**Post date:** [February 6, 2024, 8:40am UTC](https://discuss.elastic.co/t/syslog-output-plugin-message-parameter-ignored/352560/3 "2024-02-06T08:40:05Z")

</div>

With this output config the syslog message field is not set to ` ___A___ ` it is just set to the message field of the event.

```auto
output {
  syslog {
    host => "10.0.0.1"
    port => 514
    protocol => "tcp"
    rfc => "rfc5424" # Needed for msgid
    msgid => "_logstash_"
    sourcehost => "%{[log][hostname]}"
    message => " ___A___" # This does not work
   }
}

```

Question:

```auto
config :format, :validate => :string

```

What does this do as default is it nil or ""

I can't quite follow [mixin](https://github.com/elastic/logstash/blob/main/logstash-core/lib/logstash/config/mixin.rb#L49)

somehow one of these conditions must be false

```auto
 if @codec.class.name == "LogStash::Codecs::Plain"
      if @codec.config["format"].nil?
        @codec = LogStash::Codecs::Plain.new({"format" => @message})
      end
    end

```

The message parameter of the syslog codec is being ignored

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 16, 2024, 5:22pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-message-parameter-ignored/352560/4 "2024-02-16T17:22:14Z")

</div>

I think [this](https://github.com/logstash-plugins/logstash-output-syslog/issues/51) issue covers this. The == does not work as expected. The issue includes a workaround.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2024, 5:23pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-message-parameter-ignored/352560/5 "2024-03-15T17:23:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.