From ca73f14686483640a536af9a355a10b5e5f6145d Mon Sep 17 00:00:00 2001
From: Brian Candler <b.candler@pobox.com>
Date: Fri, 16 Aug 2019 17:08:14 +0000
Subject: [PATCH] Include log.source.address for unparseable syslog messages

Fixes #13268
---
 filebeat/input/syslog/input.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/filebeat/input/syslog/input.go b/filebeat/input/syslog/input.go
index 10365c6d3f91..71f7a508e763 100644
--- a/filebeat/input/syslog/input.go
+++ b/filebeat/input/syslog/input.go
@@ -141,6 +141,11 @@ func NewInput(
 				},
 				Fields: common.MapStr{
 					"message": string(data),
+					"log": common.MapStr{
+						"source": common.MapStr{
+							"address": metadata.RemoteAddr.String(),
+						},
+					},
 				},
 			})
 		} else {