-
Notifications
You must be signed in to change notification settings - Fork 2.6k
/
Copy pathsyslog_input.md
44 lines (31 loc) · 1.31 KB
/
syslog_input.md
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
## `syslog_input` operator
The `syslog_input` operator listens for syslog format logs from UDP/TCP packages.
### Configuration Fields
| Field | Default | Description |
| --- | --- | --- |
| `id` | `syslog_input` | A unique identifier for the operator. |
| `output` | Next in pipeline | The connected operator(s) that will receive all outbound entries. |
| `tcp` | {} | A [tcp_input config](./tcp_input.md#configuration-fields) to defined syslog_parser operator. |
| `udp` | {} | A [udp_input config](./udp_input.md#configuration-fields) to defined syslog_parser operator. |
| `syslog` | required | A [syslog parser config](./syslog_parser.md#configuration-fields) to defined syslog_parser operator. |
| `attributes` | {} | A map of `key: value` pairs to add to the entry's attributes. |
| `resource` | {} | A map of `key: value` pairs to add to the entry's resource. |
### Example Configurations
#### Simple
TCP Configuration:
```yaml
- type: syslog_input
tcp:
listen_adress: "0.0.0.0:54526"
syslog:
protocol: rfc5424
```
UDP Configuration:
```yaml
- type: syslog_input
udp:
listen_adress: "0.0.0.0:54526"
syslog:
protocol: rfc3164
location: UTC
```