syslog source
The syslog
source ingests data through the Syslog 5424 protocol and outputs log
events.
Configuration
- Common
- Advanced
[sources.my_source_id]# REQUIREDtype = "syslog" # example, must be: "syslog"mode = "tcp" # example, enum# OPTIONALaddress = "0.0.0.0:9000" # example, no default, relevant when mode = "tcp" or mode = "udp"path = "/path/to/socket" # example, no default, relevant when mode = "unix"
Options
address
The TCP or UDP address to listen for connections on, or "systemd#N" to use the Nth socket passed by systemd socket activation.
host_key
The key name added to each event representing the current host. See Context for more info.
"host"
max_length
The maximum bytes size of incoming messages before they are discarded.
102400
mode
The input mode.
"tcp"
"udp"
"unix"
path
The unix socket path. This should be absolute path.
Output
This component outputs log
events.
For example:
{"appname": "app-name","facility": "1","host": "my.host.com","message": "<13>Feb 13 20:07:26 74794bfb6795 root[8539]: i am foobar","msgid": "ID47","procid": 8710,"severity": "notice","timestamp": "2019-11-01T21:15:47+00:00","version": 1}
More detail on the output schema is below.
appname
The appname extracted from the Syslog 5424 line. If a appname is not found, then the key will not be added.
facility
The facility extracted from the Syslog 5424 line. If a facility is not found, then the key will not be added.
host
The hostname extracted from the Syslog 5424 line. If a hostname is not found, then Vector will use the upstream hostname. In the case wheremode
= "unix"
the socket path will be used.
message
The raw message, unaltered.
msgid
The msgid extracted from the Syslog 5424 line. If a msgid is not found, then the key will not be added.
procid
The procid extracted from the Syslog 5424 line. If a procid is not found, then the key will not be added.
severity
The severity extracted from the Syslog 5424 line. If a severity is not found, then the key will not be added.
timestamp
The timestamp extracted from the incoming line. If a timestamp is not found, then Vector will use the current time.
version
The version extracted from the Syslog 5424 line. If a version is not found, then the key will not be added.
How It Works
Context
By default, the syslog
source will add context
keys to your events via thehost_key
options.
Environment Variables
Environment variables are supported through all of Vector's configuration.
Simply add ${MY_ENV_VAR}
in your Vector configuration file and the variable
will be replaced before being evaluated.
You can learn more in the Environment Variables section.
Line Delimiters
Each line is read until a new line delimiter (the 0xA
byte) is found.
Parsing
Vector will only parse messages in the Syslog 5424 format.
Vector makes a best effort to parse this format. If parsing fails, the message
will be dropped and warning
log line will be emitted. If this is the case, we
recommend using the tcp
source combined with the
regex_parser
transform to implement your own
ingestion and parsing scheme.