Skip to content

syslog.md

Latest commit

 

History

History
85 lines (54 loc) · 2.77 KB

syslog.md

File metadata and controls

85 lines (54 loc) · 2.77 KB
title Syslog Destinations
disable_toc false
products
name icon url
Logs
logs
/observability_pipelines/configuration/?tab=logs#pipeline-types

{{< product-availability >}}

Overview

Use Observability Pipelines' syslog destinations to send logs to rsyslog or syslog-ng.

Setup

Set up the rsyslog or syslog-ng destination and its environment variables when you set up a pipeline. The information below is configured in the pipelines UI.

Set up the destination

The rsyslog and syslog-ng destinations support the RFC5424 format.

The rsyslog and syslog-ng destinations match these log fields to the following Syslog fields:

Log Event SYSLOG FIELD Default
log["message"] MESSAGE NIL
log["procid"] PROCID The running Worker's process ID.
log["appname"] APP-NAME observability_pipelines
log["facility"] FACILITY 8 (log_user)
log["msgid"] MSGID NIL
log["severity"] SEVERITY info
log["host"] HOSTNAME NIL
log["timestamp"] TIMESTAMP Current UTC time.
Only enter the identifiers for the syslog endpoint URL and, if applicable, the key pass. Do not enter the actual values.

To set up the syslog destination in the UI:

  • Enter the identifier for your endpoint URL. If you leave it blank, the default is used.

Optional settings

Enable TLS

{{% observability_pipelines/tls_settings %}}

Wait time for TCP keepalive probes

Enter the number of seconds to wait before sending TCP keepalive probes on an idle connection.

Buffering

{{% observability_pipelines/destination_buffer %}}

Set secrets

{{% observability_pipelines/set_secrets_intro %}}

{{< tabs >}} {{% tab "Secrets Management" %}}

  • rsyslog or syslog-ng endpoint URL identifier:
    • References the address and port to which Observability Pipelines Worker sends logs. For example, 127.0.0.1:9997.
    • The default identifier is DESTINATION_SYSLOG_ENDPOINT_URL.
  • rsyslog or syslog-ng TLS passphrase identifier (when TLS is enabled):
    • The default identifier is DESTINATION_SYSLOG_KEY_PASS.

{{% /tab %}}

{{% tab "Environment Variables" %}}

{{% observability_pipelines/configure_existing_pipelines/destination_env_vars/syslog %}}

{{% /tab %}} {{< /tabs >}}

How the destination works

Event batching

The rsyslog and syslog-ng destinations do not batch events.