Syslog output plugin :number type input parametrization

[arirajamaki (Ari)]

Hello Community,

I'm in trouble with my logstash pipeline configuration.
I'm trying to use syslog output plugin so that I can dynamically change the destination syslog server port. I'm trying do tcp/udp connection to different syslog server based on the source of event.

Do this I'm trying to assign syslog output plugin port from @metadata field, initialized earlier in the logstash pipeline per event source type (see below error).

I'm been trying to use

• convert to integer mutate filter
• using event field instead of @metadata field

When I'm assigning port variable from environment variable ${syslogport} it does work, but problem is that I cannot dynamically change the parameter value in the pipeline

I can use other @metadata field without problems (when the type is string)

Problem I'm facing is that plugin doesn't accept parameter because it's not number type.

[ERROR] 2023-01-10 22:59:48.959 [Converge PipelineAction::Create] syslog - Invalid setting for syslog output plugin:

  output {
    syslog {
      # This setting must be a number
      # Expected number, got "%[@metadata][syslogport]" (type %[@metadata][syslogport])
      port => "%[@metadata][syslogport]"
      ...
    }
  }

Thanks for the support

[Rios]

It seems it's not possible even you do conversion [@metadata][syslogport] to integer or port => "%{[@metadata][syslogport]}". The settings: port=>"3456" as string is working.

How many ports do you have? If is a few of them you can use IFs and hardcoded port numbs.

[arirajamaki (Ari)]

Thanks Rios for reply,

I have only two destination ports, so yes IF condition and hardcoding via environment variables is an option for me

I just wanted to check that Am I missing some basics of logstash pipeline configuration possibilities.

I did try to use event field like [syslogport] with and without convertion to integer (same result)

[Rios]

No need for an ENV variable, try this:

if [@metadata][syslogport]== "111"
{
    syslog {
      port => 111
      host => "192.168.1.1"
    }
}
else if [@metadata][syslogport]== "222"
{
    syslog {
      port => 222
      host => "192.168.1.2"
    }
}