Syslog

Syslog (syslog)

Accept RFC 3164 and RFC 5424 syslog records over UDP, TCP, or TLS.

Observability Enterprise edition json

Minimal example

input:
  syslog:
    listen: "udp://127.0.0.1:5514"

JSON

{
  "input": {
    "syslog": {
      "listen": "udp://127.0.0.1:5514"
    }
  }
}

Contents

• Minimal example

• Attributes

• Batching

• Connection

• Limits

• Reliability

• Security

• Schema

A ✓ marks a field that accepts a context variable such as {{ VARIABLE }}.

Attributes

Attributes

Field	Type	Required	Description
default-attributes ✓	map (string)		Static attributes merged into each emitted event.

Batching

Batching

Field	Type	Required	Description
batch	Batch		Optional batching semantics shared with other inputs.

Connection

Connection

Field	Type	Required	Description
listen	socket-address (string)	✅	Listener endpoint, for example udp://127.0.0.1:5514. Examples: localhost:443
framing	Framing		Framing used by TCP and TLS streams; UDP always uses one datagram per record. Allowed values: octet-counting, newline

Limits

Limits

Field	Type	Required	Description
max-message-bytes	number (integer)		Maximum accepted syslog record size in bytes. Examples: 42, 1.2e-10
max-connections	number (integer)		Maximum concurrent TCP or TLS client connections. Examples: 42, 1.2e-10

Reliability

Reliability

Field	Type	Required	Description
retry	Retry		Retry configuration applied to downstream emission.

Security

Security

Field	Type	Required	Description
tls	Tls		Server certificate and optional mutual-TLS configuration.

Schema

• Batch Fields
• Retry - Backoff Fields
• Retry Fields
• Tls Fields
• Default Attributes Table
• Framing Options
• Retry - Backoff - Strategy Options

Batch Fields

Field	Type	Required	Description
uuid-field	field (string)		Field where generated uuid, the unique marker for the group, will be stored. Examples: data_field
invocation-time-field	field (string)		Field where invocation time will be stored. Examples: data_field
completion-time-field	field (string)		Field where completion (end of execution) time will be stored. Examples: data_field
begin-marker-field	field (string)		Field used to mark first event in the group. Examples: data_field
end-marker-field	field (string)		Field used to mark last event in the group. Examples: data_field
line-count-field	field (string)		Field used to store the line count of the batch. Examples: data_field
line-num-field	field (string)		Field used to store the line number of the batch. Examples: data_field

Retry - Backoff Fields

Field	Type	Required	Description
strategy	Strategy		Backoff strategy to use (default exponential). Allowed values: exponential, linear, fixed
base	string		Base delay before retrying (e.g. “200ms”).
max	string		Maximum delay between retries.
jitter ✓	boolean (bool)		Whether to add jitter to retry delays. Default: false

Retry Fields

Field	Type	Required	Description
max-attempts	number (integer)		Maximum attempts before giving up. Examples: 42, 1.2e-10
forever ✓	boolean (bool)		Retry indefinitely until cancelled. Default: false
backoff	Backoff		Backoff strategy configuration.

Tls Fields

Field	Type	Required	Description
certificate ✓	templated-text (string)	✅	Path to the PEM certificate chain presented by the listener. Examples: here is a ${field} expansion
private-key ✓	templated-text (string)	✅	Path to the PEM private key matching the listener certificate. Examples: here is a ${field} expansion
client-ca ✓	templated-text (string)		Optional path to a PEM CA bundle used to verify client certificates. Examples: here is a ${field} expansion
require-client-auth ✓	boolean (bool)		Require every client to present a certificate trusted by client-ca. Default: false

Default Attributes Table

Attribute	Value
site	edge-a

Value format: templated-text.

Framing Options

Value	Aliases	Name	Description
octet-counting		octet-counting
newline		newline

Retry - Backoff - Strategy Options

Value	Aliases	Name	Description
exponential		exponential
linear		linear
fixed		fixed