LOG

Syslog Source

The Vector syslog source ingests data through the Syslog protocol and outputs log events.

Configuration

  • Common
  • Advanced
vector.toml
[sources.my_source_id]
  # REQUIRED - General
  type = "syslog" # must be: "syslog"
  mode = "tcp" # example, enum


  # OPTIONAL - Context
  host_key = "host" # default


  # OPTIONAL - General
  address = "0.0.0.0:9000" # example, no default, relevant when mode = "tcp" or mode = "udp"
  path = "/path/to/socket" # example, no default, relevant when mode = "unix"

Options

5 items
stringcommonoptional

address

The TCP or UDP address to listen for connections on, or "systemd#N" to use the Nth socket passed by systemd socket activation.

No default
Only relevant when: mode = ["tcp","udp"]
View examples
stringcommonrequired

host_key

The key name added to each event representing the current host. This can also be globally set via the global [host_key](#host_key) option. See Context for more info.

Default: "host"
View examples
int (bytes)optional

max_length

The maximum bytes size of incoming messages before they are discarded.

Default: 102400 (bytes)
View examples
stringenumcommonrequired

mode

The input mode.

No default
Enum, must be one of: "tcp" "udp" "unix"
View examples
stringcommonoptional

path

The unix socket path. This should be absolute path.

No default
Only relevant when: mode = "unix"
View examples

Output

The syslog source ingests data through the Syslog protocol and outputs log events. For example:

{
  "appname": "app-name",
  "facility": "1",
  "host": "my.host.com",
  "message": "<13>Feb 13 20:07:26 74794bfb6795 root[8539]: i am foobar",
  "msgid": "ID47",
  "procid": 8710,
  "severity": "notice",
  "timestamp": "2019-11-01T21:15:47+00:00",
  "version": 1
}

More detail on the output schema is below.

9 items
stringoptional

appname

The appname extracted from the Syslog formatted line. If a appname is not found, then the key will not be added.

No default
View examples
stringoptional

facility

The facility extracted from the Syslog line. If a facility is not found, then the key will not be added.

No default
View examples
stringcommonrequired

host

The hostname extracted from the Syslog line. If a hostname is not found, then Vector will use the upstream hostname. In the case where mode = "unix" the socket path will be used. This key can be renamed via the host_key option.

No default
View examples
stringcommonrequired

message

The raw message, unaltered. See Parsing for more info.

No default
View examples
stringoptional

msgid

The msgid extracted from the Syslog line. If a msgid is not found, then the key will not be added.

No default
View examples
intoptional

procid

The procid extracted from the Syslog line. If a procid is not found, then the key will not be added.

No default
View examples
stringoptional

severity

The severity extracted from the Syslog line. If a severity is not found, then the key will not be added.

No default
View examples
timestampcommonrequired

timestamp

The timestamp extracted from the incoming line. If a timestamp is not found, then Vector will use the current time.

No default
View examples
intoptional

version

The version extracted from the Syslog line. If a version is not found, then the key will not be added.

No default
View examples

How It Works

Context

By default, the syslog source will add context keys to your events via the host_key options.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Line Delimiters

Each line is read until a new line delimiter (the 0xA byte) is found.

Parsing

Vector makes a best effort to parse the various Syslog formats out in the wild. This includes RFC 5424, RFC 3164, and other common variations (such as the Nginx Syslog style). It's unfortunate that the Syslog specification is not more accurately followed, but we hope Vector insulates you from these diviations.

If parsing fails, Vector will include the entire Syslog line in the message key. If you find this happening often, we recommend using the socket source combined with the regex_parser transform to implement your own ingestion and parsing scheme. Or, open an issue requesting support for your specific format.

Support
Contents
Resources