You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+17
Original file line number
Diff line number
Diff line change
@@ -194,6 +194,7 @@ If you use multiline logging with raw, it's recommended to json encode the Data
194
194
*`SYSLOG_PRIORITY` - datum for priority field (default `{{.Priority}}`)
195
195
*`SYSLOG_STRUCTURED_DATA` - datum for structured data field
196
196
*`SYSLOG_TAG` - datum for tag field (default `{{.ContainerName}}+route.Options["append_tag"]`)
197
+
*`SYSLOG_TCP_FRAMING` - for TCP or TLS transports, whether to use `octet-counted` framing in emitted messages or `traditional` LF framing (default `traditional`)
197
198
*`SYSLOG_TIMESTAMP` - datum for timestamp field (default `{{.Timestamp}}`)
198
199
*`MULTILINE_ENABLE_DEFAULT` - enable multiline logging for all containers when using the multiline adapter (default `true`)
199
200
*`MULTILINE_MATCH` - determines which lines the pattern should match, one of first|last|nonfirst|nonlast, for details see: [MULTILINE_MATCH](#multiline_match) (default `nonfirst`)
@@ -250,6 +251,22 @@ Use examples:
250
251
251
252
```
252
253
254
+
#### Syslog TCP Framing
255
+
256
+
When using a TCP or TLS transport with the Syslog adapter, it is possible to add octet-counting to the emitted frames as described in [RFC6587 (Syslog over TCP) 3.4.1](https://tools.ietf.org/html/rfc6587#section-3.4.1) and [RFC5424 (Syslog over TLS)](https://tools.ietf.org/html/rfc5424).
257
+
258
+
This prefixes each message with the length of the message to allow consumers to easily determine where the message ends (rather than traditional LF framing). This also enables multiline Syslog messages without escaping.
259
+
260
+
To enable octet-counted framing for Syslog over TCP or TLS, use the `SYSLOG_TCP_FRAMING` environment variable:
> NOTE: The default is to use traditional LF framing for backwards compatibility though octet-counted framing is preferred when it is known the downstream consumer can handle it.
269
+
253
270
#### Using Logspout in a swarm
254
271
255
272
In a swarm, logspout is best deployed as a global service. When running logspout with 'docker run', you can change the value of the hostname field using the `SYSLOG_HOSTNAME` environment variable as explained above. However, this does not work in a compose file because the value for `SYSLOG_HOSTNAME` will be the same for all logspout "tasks", regardless of the docker host on which they run. To support this mode of deployment, the syslog adapter will look for the file `/etc/host_hostname` and, if the file exists and it is not empty, will configure the hostname field with the content of this file. You can then use a volume mount to map a file on the docker hosts with the file `/etc/host_hostname` in the container. The sample compose file below illustrates how this can be done
0 commit comments