title: logback logstash encoder Syslog header not set
body: <p>I'm trying to log Java logs to Syslog in JSON format but I've found a strange issue where the Syslog header is not being set as expected.</p>
  
  <p>I'm testing this on a Mac and using wireshark to grab the packets as they get sent to the UDP 514 port (via loopback interface)</p>
  
  <p>My logback.xml is as follows:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;configuration&gt;
    &lt;conversionRule conversionWord="syslogStart" converterClass="ch.qos.logback.classic.pattern.SyslogStartConverter"/&gt;
  
    &lt;appender name="stash" class="net.logstash.logback.appender.LogstashSocketAppender"&gt;
      &lt;host&gt;localhost&lt;/host&gt;
      &lt;port&gt;514&lt;/port&gt;
      &lt;prefix class="ch.qos.logback.core.encoder.LayoutWrappingEncoder"&gt;
        &lt;layout class="ch.qos.logback.classic.PatternLayout"&gt;
          &lt;pattern&gt;%syslogStart{LOCAL5}&lt;/pattern&gt;
        &lt;/layout&gt;
      &lt;/prefix&gt;
    &lt;/appender&gt;
  
    &lt;root level="INFO"&gt;
      &lt;appender-ref ref="stash"/&gt;
    &lt;/root&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>and when I look at the output of wireshark I only see the JSON being logged (no PRI header field given)</p>
  
  <pre><code> [truncated]Syslog message: (unknown): {"@timestamp":"2016-03-22T12:13:37.270+11:00","@version":1,"message":"Started App in 4.327 seconds (JVM running for 4.92)","logger_name":"au.com.xxx.App","threa
  </code></pre>
  
  <p>If I switch to the standard logback Syslog appender (non JSON output)</p>
  
  <pre><code>...
    &lt;appender name="SYSLOG" class="ch.qos.logback.classic.net.SyslogAppender"&gt;
      &lt;syslogHost&gt;127.0.0.1&lt;/syslogHost&gt;
      &lt;Facility&gt;LOCAL5&lt;/Facility&gt;
      &lt;SuffixPattern&gt;%-5level MyApp %logger %msg&lt;/SuffixPattern&gt;
    &lt;/appender&gt;
  ...
  </code></pre>
  
  <p>I do see the correct header facility raw value &lt;174> and parsed values LOCAL5.INFO in the wireshark packets</p>
  
  <pre><code> Syslog message: LOCAL5.INFO: Mar 22 12:31:03 sbmelmac-06390.local INFO  App au.com.App Started App in 11.292 seconds (JVM running for 29.336)
  </code></pre>
  
  <p>The syslog header is required (in the syslog conf) to route the log messages to the correct files so without this I can't filter out log entries based on facility filters.</p>
  
  <p>I'm using SpringBoot (1.2.7), (which uses logback 1.1.3), apache camel (2.16.1) and logstash-logback-encoder (4.6)</p>
  
  <p>When I run in debug it looks like the SyslogStartConverter.convert method is never invoked.</p>
  
  <p>Cheers
  Roy</p>