elastic / elastic/beats

Keep original log message when using Syslog input

Open
#15,434 3 comments 1 reaction 0 assignees View on GitHub
[zube]: Inbox enhancement Filebeat Team:Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

**Describe the enhancement:**
When using the syslog input the original message is not stored in log.original. As processors run after the input parsing is completed you cannot use copy_field to get the original message back.

**Describe a specific use case for the enhancement or feature:**
Allow for reprocessing of syslogs in the future and allow for viewing the entire original log message.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.