# Using the syslog appender in elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [December 29, 2011, 3:52am UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248 "2011-12-29T03:52:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Darron\_Froese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darron_froese/32/2984_2.png) [@Darron\_Froese](https://discuss.elastic.co/u/Darron_Froese)\ **Post date:** [December 29, 2011, 3:52am UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248/1 "2011-12-29T03:52:17Z")
I'm trying to log the Elasticsearch output via syslog to Papertrail. The rest of the machine works just fine already - all syslog output automatically goes to them via this rule: _._@logs.papertrailapp.com:xxxxx Here is my ES logging config: > **[rootLogger: INFO, console, file logger: jgroups: WARN # log action execution...](http://d.pr/pXwe)** > > rootLogger: INFO, console, file > logger: > jgroups: WARN > # log action execution errors for easier debugging > action : INFO > > appender: > console: > type: console > layout: > type: console... Nothing from Elasticsearch makes it over to Papertrail. Anybody ever dealt with this? Any pointers? ---
**Author:** ![Ludovic\_Levesque](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ludovic_levesque/32/3031_2.png) [@Ludovic\_Levesque](https://discuss.elastic.co/u/Ludovic_Levesque)\ **Post date:** [December 29, 2011, 2:47pm UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248/2 "2011-12-29T14:47:14Z")
Hi, you have to put 'syslog' in your rootLogger Ludo On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese [darron@nonfiction.ca](mailto:darron@nonfiction.ca) wrote: > I'm trying to log the Elasticsearch output via syslog to Papertrail. > The rest of the machine works just fine already - all syslog output > automatically goes to them via this rule: > > _._@logs.papertrailapp.com:xxxxx > > Here is my ES logging config: > > [http://d.pr/pXwe](http://d.pr/pXwe) > > Nothing from Elasticsearch makes it over to Papertrail. > > Anybody ever dealt with this? > > Any pointers? ---
**Author:** ![Darron\_Froese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darron_froese/32/2984_2.png) [@Darron\_Froese](https://discuss.elastic.co/u/Darron_Froese)\ **Post date:** [December 29, 2011, 7:33pm UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248/3 "2011-12-29T19:33:46Z")
Hmm - I've done that - it doesn't seem to work: [http://d.pr/yPkr](http://d.pr/yPkr) I think I'm putting things in the right place - any other ideas? On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque [luddic@gmail.com](mailto:luddic@gmail.com) wrote: > Hi, > > you have to put 'syslog' in your rootLogger > > Ludo > > On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese [darron@nonfiction.ca](mailto:darron@nonfiction.ca) wrote: > > > I'm trying to log the Elasticsearch output via syslog to Papertrail. > > The rest of the machine works just fine already - all syslog output > > automatically goes to them via this rule: > > > > _._@logs.papertrailapp.com:xxxxx > > > > Here is my ES logging config: > > > > [http://d.pr/pXwe](http://d.pr/pXwe) > > > > Nothing from Elasticsearch makes it over to Papertrail. > > > > Anybody ever dealt with this? > > > > Any pointers? ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [December 30, 2011, 12:38pm UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248/4 "2011-12-30T12:38:07Z")
Do you see anything failing on the console output (run it in the foreground)? I've never used log4j with syslog, but your config looks good. On Thu, Dec 29, 2011 at 9:33 PM, Darron Froese [darron@nonfiction.ca](mailto:darron@nonfiction.ca) wrote: > Hmm - I've done that - it doesn't seem to work: > > [http://d.pr/yPkr](http://d.pr/yPkr) > > I think I'm putting things in the right place - any other ideas? > > On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque [luddic@gmail.com](mailto:luddic@gmail.com) > wrote: > > > Hi, > > > > you have to put 'syslog' in your rootLogger > > > > Ludo > > > > On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese [darron@nonfiction.ca](mailto:darron@nonfiction.ca) > > wrote: > > > > > I'm trying to log the Elasticsearch output via syslog to Papertrail. > > > The rest of the machine works just fine already - all syslog output > > > automatically goes to them via this rule: > > > > > > _._@logs.papertrailapp.com:xxxxx > > > > > > Here is my ES logging config: > > > > > > [http://d.pr/pXwe](http://d.pr/pXwe) > > > > > > Nothing from Elasticsearch makes it over to Papertrail. > > > > > > Anybody ever dealt with this? > > > > > > Any pointers? ---
**Author:** ![Antonio\_Lobato](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antonio_lobato/32/2681_2.png) [@Antonio\_Lobato](https://discuss.elastic.co/u/Antonio_Lobato)\ **Post date:** [October 17, 2012, 5:05pm UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248/5 "2012-10-17T17:05:57Z")
Bumping this old thread with new info: Darron's config is actually right on, except for one tiny thing. The sysloghost line actually has to read: "syslogHost", with a capital H. Works like a charm after that. 🙂 On Friday, December 30, 2011 7:38:07 AM UTC-5, kimchy wrote: > Do you see anything failing on the console output (run it in > the foreground)? I've never used log4j with syslog, but your config looks > good. > > On Thu, Dec 29, 2011 at 9:33 PM, Darron Froese \ > > > wrote: > > > Hmm - I've done that - it doesn't seem to work: > > > > [http://d.pr/yPkr](http://d.pr/yPkr) > > > > I think I'm putting things in the right place - any other ideas? > > > > On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque \<[lud...@gmail.com](mailto:lud...@gmail.com)\\> > > wrote: > > > > > Hi, > > > > > > you have to put 'syslog' in your rootLogger > > > > > > Ludo > > > > > > On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese \\> > > > wrote: > > > > > > > I'm trying to log the Elasticsearch output via syslog to Papertrail. > > > > The rest of the machine works just fine already - all syslog output > > > > automatically goes to them via this rule: > > > > > > > > _._@logs.papertrailapp.com:xxxxx > > > > > > > > Here is my ES logging config: > > > > > > > > [http://d.pr/pXwe](http://d.pr/pXwe) > > > > > > > > Nothing from Elasticsearch makes it over to Papertrail. > > > > > > > > Anybody ever dealt with this? > > > > > > > > Any pointers? -- ---
**Author:** ![releasebeta](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@releasebeta](https://discuss.elastic.co/u/releasebeta)\ **Post date:** [October 8, 2014, 6:56pm UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248/6 "2014-10-08T18:56:13Z")
Can someone post the working logging.yml for this? I tried with syslog: type: syslog sysloghost: localhost facility: local1 layout: type: pattern conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n" But nothing got pushed to syslog. My logs are going to /var/log/elasticsearch.log but nothing goes to syslog. I need to push them to papertrail later using simple rsyslog forwarding. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:57am UTC](https://discuss.elastic.co/t/using-the-syslog-appender-in-elasticsearch/6248/7 "2017-07-06T00:57:29Z")