Skip to content

pipeline: outputs: syslog: general cleanup #1990

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 23, 2025
Merged

pipeline: outputs: syslog: general cleanup #1990

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d1ca515
pipeline: outputs: syslog: general cleanup
alexakreizinger Jul 23, 2025
7eb1f86
Apply suggestions from code review
alexakreizinger Jul 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 37 additions & 43 deletions pipeline/outputs/syslog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,46 +1,40 @@
# Syslog

The Syslog output plugin allows you to deliver messages to Syslog servers. It supports RFC3164 and RFC5424 formats through different transports such as UDP, TCP or TLS.

As of Fluent Bit v1.5.3 the configuration is very strict.
You must be aware of the structure of your original record so you can configure the plugin to use specific keys to compose your outgoing Syslog message.

> Future versions of Fluent Bit are expanding this plugin feature set to support better handling of keys and message composing.

## Configuration Parameters

| Key | Description | Default |
|:-------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|
| host | Domain or IP address of the remote Syslog server. | 127.0.0.1 |
| port | TCP or UDP port of the remote Syslog server. | 514 |
| mode | Desired transport type. Available options are `tcp` and `udp`. | udp |
| syslog\_format | The Syslog protocol format to use. Available options are `rfc3164` and `rfc5424`. | rfc5424 |
| syslog\_maxsize | The maximum size allowed per message. The value must be an integer representing the number of bytes allowed. If no value is provided, the default size is set depending of the protocol version specified by `syslog_format`.<br><br>`rfc3164` sets max size to 1024 bytes.<br><br>`rfc5424` sets the size to 2048 bytes. | |
| syslog\_severity\_key | The key name from the original record that contains the Syslog severity number. This configuration is optional. | |
| syslog\_severity\_preset | The preset severity number. It will be overwritten if `syslog_severity_key` is set and a key of a record is matched. This configuration is optional. | 6 |
| syslog\_facility\_key | The key name from the original record that contains the Syslog facility number. This configuration is optional. | |
| syslog\_facility\_preset | The preset facility number. It will be overwritten if `syslog_facility_key` is set and a key of a record is matched. This configuration is optional. | 1 |
| syslog\_hostname\_key | The key name from the original record that contains the hostname that generated the message. This configuration is optional. | |
| syslog\_hostname\_preset | The preset hostname. It will be overwritten if `syslog_hostname_key` is set and a key of a record is matched. This configuration is optional. | |
| syslog\_appname\_key | The key name from the original record that contains the application name that generated the message. This configuration is optional. | |
| syslog\_appname\_preset | The preset application name. It will be overwritten if `syslog_appname_key` is set and a key of a record is matched. This configuration is optional. | |
| syslog\_procid\_key | The key name from the original record that contains the Process ID that generated the message. This configuration is optional. | |
| syslog\_procid\_preset | The preset process ID. It will be overwritten if `syslog_procid_key` is set and a key of a record is matched. This configuration is optional. | |
| syslog\_msgid\_key | The key name from the original record that contains the Message ID associated to the message. This configuration is optional. | |
| syslog\_msgid\_preset | The preset message ID. It will be overwritten if `syslog_msgid_key` is set and a key of a record is matched. This configuration is optional. | |
| syslog\_sd\_key | The key name from the original record that contains a map of key/value pairs to use as Structured Data \(SD\) content. The key name is included in the resulting SD field as shown in examples below. This configuration is optional. | |
| syslog\_message\_key | The key name from the original record that contains the message to deliver. Note that this property is **mandatory**, otherwise the message will be empty. | |
| allow\_longer\_sd\_id | If true, Fluent-bit allows SD-ID that is longer than 32 characters. Such long SD-ID violates RFC 5424. | false |
| workers | The number of [workers](../../administration/multithreading.md#outputs) to perform flush operations for this output. | `0` |
The _Syslog_ output plugin lets you deliver messages to Syslog servers. It supports RFC3164 and RFC5424 formats through different transports such as UDP, TCP or TLS.

## Configuration parameters

| Key | Description | Default |
| --- | ----------- | ------- |
| `host` | Domain or IP address of the remote Syslog server. | `127.0.0.1` |
| `port` | TCP or UDP port of the remote Syslog server. | `514` |
| `mode` | Desired transport type. Available options are `tcp` and `udp`. | `udp` |
| `syslog_format` | The Syslog protocol format to use. Available options are `rfc3164` and `rfc5424`. | `rfc5424` |
| `syslog_maxsize` | The maximum size allowed per message. The value must be an integer representing the number of bytes allowed. If no value is provided, the default size is set depending of the protocol version specified by `syslog_format`. The value `rfc3164` sets max size to 1024 bytes, and `rfc5424` sets the size to 2048 bytes. | _none_ |
| `syslog_severity_key` | The key name from the original record that contains the Syslog severity number. This configuration is optional. | _none_ |
| `syslog_severity_preset` | The preset severity number. It will be overwritten if `syslog_severity_key` is set and a key of a record is matched. This configuration is optional. | `6` |
| `syslog_facility_key` | The key name from the original record that contains the Syslog facility number. This configuration is optional. | _none_ |
| `syslog_facility_preset` | The preset facility number. It will be overwritten if `syslog_facility_key` is set and a key of a record is matched. This configuration is optional. | `1` |
| `syslog_hostname_key` | The key name from the original record that contains the hostname that generated the message. This configuration is optional. | _none_ |
| `syslog_hostname_preset` | The preset hostname. It will be overwritten if `syslog_hostname_key` is set and a key of a record is matched. This configuration is optional. | _none_ |
| `syslog_appname_key` | The key name from the original record that contains the application name that generated the message. This configuration is optional. | _none_ |
| `syslog_appname_preset` | The preset application name. It will be overwritten if `syslog_appname_key` is set and a key of a record is matched. This configuration is optional. | _none_ |
| `syslog_procid_key` | The key name from the original record that contains the Process ID that generated the message. This configuration is optional. | _none_ |
| `syslog_procid_preset` | The preset process ID. It will be overwritten if `syslog_procid_key` is set and a key of a record is matched. This configuration is optional. | _none_ |
| `syslog_msgid_key` | The key name from the original record that contains the Message ID associated to the message. This configuration is optional. | _none_ |
| `syslog_msgid_preset` | The preset message ID. It will be overwritten if `syslog_msgid_key` is set and a key of a record is matched. This configuration is optional. | _none_ |
| `syslog_sd_key` | The key name from the original record that contains a map of key/value pairs to use as Structured Data \(SD\) content. The key name is included in the resulting SD field as shown in the examples in this doc. This configuration is optional. | _none_ |
| `syslog_message_key` | The key name from the original record that contains the message to deliver. Be aware that this property is required, otherwise the message will be empty. | _none_ |
| `allow_longer_sd_id` | If `true`, Fluent-bit allows SD-ID values that are longer than 32 characters. SD-ID values that exceed 32 characters violate RFC5424 standards. | `false` |
| `workers` | The number of [workers](../../administration/multithreading.md#outputs) to perform flush operations for this output. | `0` |

### TLS / SSL

The Syslog output plugin supports TLS/SSL.
For more details about the properties available and general configuration, see [TLS/SSL](../../administration/transport-security.md).
The Syslog output plugin supports TLS/SSL. For more details about the properties available and general configuration, see [TLS/SSL](../../administration/transport-security.md).

## Examples

### Configuration File
### Configuration file

Get started quickly with this configuration file:

Expand All @@ -49,7 +43,7 @@ Get started quickly with this configuration file:

```yaml
pipeline:

outputs:
- name: syslog
match: "*"
Expand Down Expand Up @@ -93,7 +87,7 @@ pipeline:
{% endtab %}
{% endtabs %}

### Structured Data
### Structured data

The following is an example of how to configure the `syslog_sd_key` to send Structured Data to the remote Syslog server.

Expand Down Expand Up @@ -121,7 +115,7 @@ Example configuration file:

```yaml
pipeline:

outputs:
- name: syslog
match: "*"
Expand Down Expand Up @@ -169,18 +163,18 @@ Example output:
...
```

### Adding Structured Data Authentication Token
### Add structured data authentication token

Some services use the structured data field to pass authentication tokens (for example, `[<token>@41018]`), which would need to be added to each log message dynamically. However, this requires setting the token as a key rather than as a value.

Some services use the structured data field to pass authentication tokens (e.g. `[<token>@41018]`), which would need to be added to each log message dynamically.
However, this requires setting the token as a key rather than as a value.
Here's an example of how that might be achieved, using `AUTH_TOKEN` as a [variable](../../administration/configuring-fluent-bit/classic-mode/variables.md):

{% tabs %}
{% tab title="fluent-bit.yaml" %}

```yaml
pipeline:

filters:
- name: lua
match: "*"
Expand Down Expand Up @@ -234,4 +228,4 @@ pipeline:
```

{% endtab %}
{% endtabs %}
{% endtabs %}