syslog

Status: beta

Read syslog messages as events over the network.

This input is a good choice if you already use syslog today. It is also a good choice if you want to receive logs from appliances and network devices where you cannot run your own log collector.

Of course, 'syslog' is a very muddy term. This input only supports RFC3164 syslog with some small modifications. The date format is allowed to be RFC3164 style or ISO8601. Otherwise the rest of the RFC3164 must be obeyed. If you do not use RFC3164, do not use this input.

Note: this input will start listeners on both TCP and UDP

Synopsis

This is what it might look like in your config file:

input {
  syslog {
    add_field => ... # hash (optional), default: {}
    debug => ... # boolean (optional)
    facility_labels => ... # array (optional), default: ["kernel", "user-level", "mail", "system", "security/authorization", "syslogd", "line printer", "network news", "UUCP", "clock", "security/authorization", "FTP", "NTP", "log audit", "log alert", "clock", "local0", "local1", "local2", "local3", "local4", "local5", "local6", "local7"]
    format => ... # ["plain", "json", "json_event"] (optional)
    host => ... # string (optional), default: "0.0.0.0"
    message_format => ... # string (optional)
    port => ... # number (optional), default: 514
    severity_labels => ... # array (optional), default: ["Emergency", "Alert", "Critical", "Error", "Warning", "Notice", "Informational", "Debug"]
    tags => ... # array (optional)
    type => ... # string (required)
    use_labels => ... # boolean (optional), default: true
  }
}

Details

add_field

• Value type is hash
• Default value is {}

Add a field to an event

debug

• Value type is boolean
• There is no default value for this setting.

Set this to true to enable debugging on an input.

facility_labels

• Value type is array
• Default value is ["kernel", "user-level", "mail", "system", "security/authorization", "syslogd", "line printer", "network news", "UUCP", "clock", "security/authorization", "FTP", "NTP", "log audit", "log alert", "clock", "local0", "local1", "local2", "local3", "local4", "local5", "local6", "local7"]

Labels for facility levels This comes from RFC3164.

format

• Value can be any of: "plain", "json", "json_event"
• There is no default value for this setting.

The format of input data (plain, json, json_event)

host

• Value type is string
• Default value is "0.0.0.0"

The address to listen on

message_format

• Value type is string
• There is no default value for this setting.

If format is "json", an event sprintf string to build what the display @message should be given (defaults to the raw JSON). sprintf format strings look like %{fieldname} or %{@metadata}.

port

• Value type is number
• Default value is 514

The port to listen on. Remember that ports less than 1024 (privileged ports) may require root to use.

severity_labels

• Value type is array
• Default value is ["Emergency", "Alert", "Critical", "Error", "Warning", "Notice", "Informational", "Debug"]

Labels for severity levels This comes from RFC3164.

tags

• Value type is array
• There is no default value for this setting.

Add any number of arbitrary tags to your event.

This can help with processing later.

type (required setting)

• Value type is string
• There is no default value for this setting.

Label this input with a type. Types are used mainly for filter activation.

If you create an input with type "foobar", then only filters which also have type "foobar" will act on them.

The type is also stored as part of the event itself, so you can also use the type to search for in the web interface.

use_labels

• Value type is boolean
• Default value is true

Use label parsing for severity and facility levels

---

This is documentation from lib/logstash/inputs/syslog.rb