# Unable to send full event to syslog

**URL:** <https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339>\
**Category:** Logstash\
**Created:** [January 16, 2020, 3:12pm UTC](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339 "2020-01-16T15:12:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Necus](https://avatars.discourse-cdn.com/v4/letter/n/e47774/32.png) [@Necus](https://discuss.elastic.co/u/Necus)\
**Post date:** [January 16, 2020, 3:12pm UTC](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339/1 "2020-01-16T15:12:41Z")

</div>

Hi,  
I'm trying to send Windows logs through Windows Event Forwarder, through Winlogbeat and Logstash to syslog. (System1-\>System2 with Winlogbeat-\>Logstash-\>syslog). For some reason event which appear in syslog is cropped only to message field, no event fields, no winlog fields. The same event in Elasticsearch has all of the fields. Why output to syslog on Logstash cropped fields other than message?

---

<div class="post-metadata">

**Author:** ![Necus](https://avatars.discourse-cdn.com/v4/letter/n/e47774/32.png) [@Necus](https://discuss.elastic.co/u/Necus)\
**Post date:** [January 22, 2020, 10:55am UTC](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339/2 "2020-01-22T10:55:16Z")

</div>

Ok, simpler question then:  
Is there a way to send a full log through Winlogbeat-\>Logstash-\>syslog or is it impossible?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 22, 2020, 2:59pm UTC](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339/3 "2020-01-22T14:59:48Z")

</div>

See the documentation

> By default the contents of the `message` field will be shipped as the free-form message text part of the emitted syslog message. If your messages don’t have a `message` field or if you for some other reason want to change the emitted message, modify the `message` configuration option.

---

<div class="post-metadata">

**Author:** ![Necus](https://avatars.discourse-cdn.com/v4/letter/n/e47774/32.png) [@Necus](https://discuss.elastic.co/u/Necus)\
**Post date:** [January 24, 2020, 11:38am UTC](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339/4 "2020-01-24T11:38:17Z")

</div>

Ok, so there is a way 🙂  
Did you see any tutorial that will help me to achieve my goal?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2020, 11:38am UTC](https://discuss.elastic.co/t/unable-to-send-full-event-to-syslog/215339/5 "2020-02-21T11:38:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.