I'm unable to set severity and facility fields for output syslog with a variable value.(Variables: "syslog_facility":"clock","syslog_severity":"informational"...)
output {
syslog {
type => "syslog-relay"
facility => "%{syslog_facility}"
severity => "%{syslog_severity}"
host => "172.19.2.240"
port => 514
}
}
The error is:
Invalid setting for syslog output plugin:
output {
syslog {
This setting must be a ["kernel", "user-level", "mail", "daemon", "security/authorization", "syslogd", "line printer", "network news", "uucp", "clock", "security/authorization", "ftp", "ntp", "log audit", "log alert", "clock", "local0", "local1", "local2", "local3", "local4", "local5", "local6", "local7"]
Expected one of ["kernel", "user-level", "mail", "daemon", "security/authorization", "syslogd", "line printer", "network news", "uucp", "clock", "security/authorization", "ftp", "ntp", "log audit", "log alert", "clock", "local0", "local1", "local2", "local3", "local4", "local5", "local6", "local7"], got ["%{syslog_facility}"]
facility => ["%{syslog_facility}"]
...
}
} {:level=>:error}
Hi,
I also need to able to use this facility, I am using rsyslog to monitor a file, then I was using logstash to parse and extract the severity, facility etc to forward to a new host. I was hoping to dynamically assign these to the output. See logstash.conf file I am using below
Thanks
Matt
filter {
grok {
type => "syslog"
patterns_dir => [ "/home/whitakma/Downloads/grok/grok-master/patterns" ]
pattern => [ "%{DATESTAMP:syslogDate}%{SPACE}%{GREEDYDATA:msgRemainder}" ]
}
mutate {
type => "syslog"
replace => [ "@message", "%{msgRemainder}" ]
}
mutate {
type => "syslog"
remove => [ "msgRemainder"]
}
grok {
type => "syslog"
patterns_dir => [ "/home/whitakma/Downloads/grok/grok-master/patterns" ]
pattern => [ "%{SYSLOGFAC:syslogFac}%{NOTSPACE}%{SYSLOGSEV:syslogSev}" ]
}
mutate {
type => "syslog"
replace => [ "@facility", "%{syslogFac}" ]
replace => [ "@priority", "%{syslogSev}" ]
}
}
output {
stdout {
debug => true
#debug_format => "json"
}
syslog {
host => "x.x.x.x"
port => 514
facility => "local0" <<--
severity => "alert"
}
This is still the case in 1.2.2, need a solution.
Proposed patch:
https://github.com/logstash/logstash/pull/1039
Duplicate
Duplicate of linked issue