You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The component starts a new syslog listener for each of the given `config` blocks and fans out incoming entries to the list of receivers in `forward_to`.
|`forward_to`|`list(LogsReceiver)`| List of receivers to send log entries to. || yes |
51
52
|`relabel_rules`|`RelabelRules`| Relabeling rules to apply on log entries. |`{}`| no |
52
53
53
54
The `relabel_rules` field can make use of the `rules` export value from a [`loki.relabel`][loki.relabel] component to apply one or more relabeling rules to log entries before they're forwarded to the list of receivers in `forward_to`.
54
55
55
56
`loki.source.syslog` applies the following labels to log entries from the client information if possible.
56
57
57
-
*`__syslog_connection_ip_address`
58
-
*`__syslog_connection_hostname`
58
+
-`__syslog_connection_ip_address`
59
+
-`__syslog_connection_hostname`
59
60
60
61
`loki.source.syslog` applies the following labels to log entries if they have been parsed from the syslog message.
61
62
62
-
*`__syslog_message_severity`
63
-
*`__syslog_message_facility`
64
-
*`__syslog_message_hostname`
65
-
*`__syslog_message_app_name`
66
-
*`__syslog_message_proc_id`
67
-
*`__syslog_message_msg_id`
68
-
*`__syslog_message_msg_counter`
69
-
*`__syslog_message_sequence`
63
+
-`__syslog_message_severity`
64
+
-`__syslog_message_facility`
65
+
-`__syslog_message_hostname`
66
+
-`__syslog_message_app_name`
67
+
-`__syslog_message_proc_id`
68
+
-`__syslog_message_msg_id`
69
+
-`__syslog_message_msg_counter`
70
+
-`__syslog_message_sequence`
70
71
71
72
If there is [RFC5424](https://www.rfc-editor.org/rfc/rfc5424) compliant structured data in the parsed message, it will be applied to the log entry as a label with prefix `__syslog_message_sd_`.
72
73
For example, if the structured data provided is `[example@99999 test="value"]`, the log entry will have the label `__syslog_message_sd_example_99999_test` with a value of `value`.
@@ -91,7 +92,7 @@ loki.relabel "syslog" {
91
92
You can use the following blocks with `loki.source.syslog`:
|`address`|`string`| The `<host:port>` address to listen to for syslog messages. || yes |
118
-
|`allow_empty_rfc5424_msg`|`bool`| Whether to forward RFC5424 messages with empty MSG content. When `false`, such messages are dropped. Only applies when `syslog_format` is `rfc5424`. |`false`| no |
119
-
|`idle_timeout`|`duration`| The idle timeout for TCP connections. |`"120s"`| no |
120
-
|`label_structured_data`|`bool`| Whether to translate syslog structured data to Loki labels. |`false`| no |
121
-
|`labels`|`map(string)`| The labels to associate with each received syslog record. |`{}`| no |
122
-
123
-
|`max_message_length`|`int`| The maximum limit to the length of syslog messages. |`8192`| no |
124
-
|`protocol`|`string`| The protocol to listen to for syslog messages. Must be either `tcp` or `udp`. |`"tcp"`| no |
125
-
|`rfc3164_default_to_current_year`|`bool`| Whether to default the incoming timestamp of an `rfc3164` message to the current year. |`false`| no |
126
-
|`syslog_format`|`string`| The format for incoming messages. See [supported formats](#supported-formats). |`"rfc5424"`| no |
127
-
|`use_incoming_timestamp`|`bool`| Whether to set the timestamp to the incoming syslog record timestamp. |`false`| no |
128
-
|`use_rfc5424_message`|`bool`| Whether to forward the full RFC5424-formatted syslog message. |`false`| no |
116
+
| Name | Type | Description | Default | Required |
|`address`|`string`| The `<host:port>` address to listen to for syslog messages. || yes |
119
+
|`idle_timeout`|`duration`| The idle timeout for TCP connections. |`"120s"`| no |
120
+
|`label_structured_data`|`bool`| Whether to translate syslog structured data to Loki labels. |`false`| no |
121
+
|`labels`|`map(string)`| The labels to associate with each received syslog record. |`{}`| no |
122
+
|`max_message_length`|`int`| The maximum limit to the length of syslog messages. |`8192`| no |
123
+
|`protocol`|`string`| The protocol to listen to for syslog messages. Must be either `tcp` or `udp`. |`"tcp"`| no |
124
+
|`rfc3164_default_to_current_year`|`bool`| Whether to default the incoming timestamp of an `rfc3164` message to the current year. |`false`| no |
125
+
|`rfc5424_allow_empty_msg`|`bool`| Whether to forward RFC5424 messages with empty MSG content. When `false`, such messages are dropped. Only applies when `syslog_format` is `rfc5424`. |`false`| no |
126
+
|`syslog_format`|`string`| The format for incoming messages. See [supported formats](#supported-formats). |`"rfc5424"`| no |
127
+
|`use_incoming_timestamp`|`bool`| Whether to set the timestamp to the incoming syslog record timestamp. |`false`| no |
128
+
|`use_rfc5424_message`|`bool`| Whether to forward the full RFC5424-formatted syslog message. |`false`| no |
129
129
130
130
By default, the component assigns the log entry timestamp as the time it was processed.
131
131
@@ -134,7 +134,7 @@ The `labels` map is applied to every message that the component reads.
134
134
All header fields from the parsed RFC5424 messages are brought in as internal labels, prefixed with `__syslog_`.
135
135
136
136
If `label_structured_data` is set, structured data in the syslog header is also translated to internal labels in the form of `__syslog_message_sd_<ID>_<KEY>`.
137
-
For example, a structured data entry of `[example@99999 test="yes"]` becomes the label `__syslog_message_sd_example_99999_test` with the value `"yes"`.
137
+
For example, a structured data entry of `[example@99999 test="yes"]` becomes the label `__syslog_message_sd_example_99999_test` with the value `"yes"`.
138
138
139
139
The `rfc3164_default_to_current_year` argument is only relevant when `use_incoming_timestamp` is also set to `true`.
140
140
`rfc3164` message timestamps don't contain a year, and this component's default behavior is to mimic Promtail behavior and leave the year as 0.
@@ -146,17 +146,17 @@ The `rfc3164_default_to_current_year`, `use_incoming_timestamp` and `use_rfc5424
146
146
147
147
#### Supported formats
148
148
149
-
***`rfc3164`**
149
+
-**`rfc3164`**
150
150
A legacy syslog format, also known as BSD syslog.
151
151
Example: `<34>Oct 11 22:14:15 my-server-01 sshd[1234]: Failed password for root from 192.168.1.10 port 22 ssh2`.
152
152
`loki.source.syslog` drops messages with empty MSG content and increments the `loki_source_syslog_empty_messages_total` counter.
153
-
***`rfc5424`**
153
+
-**`rfc5424`**
154
154
A modern, structured syslog format. Uses ISO 8601 for timestamps.
|`enable_all`|`bool`| Enables all components below. |`false`| no |
207
+
|`message_counter`|`bool`| Enables syslog message counter field parsing. |`false`| no |
208
+
|`sequence_number`|`bool`| Enables service sequence number field parsing. |`false`| no |
209
+
|`hostname`|`bool`| Enables origin hostname field parsing. |`false`| no |
210
+
|`second_fractions`|`bool`| Enables milliseconds parsing in timestamp field.|`false`| no |
210
211
211
212
{{< admonition type="note" >}}
212
213
At least one option has to be enabled if `enable_all` is set to `false`.
213
214
{{< /admonition >}}
214
215
215
216
{{< admonition type="caution" >}}
216
-
The `rfc3164_cisco_components` configuration must match your Cisco device configuration.
217
+
The `rfc3164_cisco_components` configuration must match your Cisco device configuration.
217
218
The `loki.source.syslog` component cannot auto-detect which components are present because they share similar formats.
218
219
{{< /admonition >}}
219
220
@@ -240,9 +241,9 @@ ntp server <your-ntp-server>
240
241
241
242
#### Current Limitations
242
243
243
-
***Component Ordering**: When Cisco components are selectively disabled on the device but the parser expects them, parsing will fail or produce incorrect results.
244
+
-**Component Ordering**: When Cisco components are selectively disabled on the device but the parser expects them, parsing will fail or produce incorrect results.
244
245
Always match your parser configuration to your device configuration.
245
-
***Structured Data**: Messages with RFC5424-style structured data blocks (from `logging host X session-id` or `sequence-num-session`) are not currently supported.
246
+
-**Structured Data**: Messages with RFC5424-style structured data blocks (from `logging host X session-id` or `sequence-num-session`) are not currently supported.
246
247
See the [upstream issue][go-syslog-issue] for details.
![grafana-alloybot[bot]](https://avatars.githubusercontent.com/in/879451?v=4&size=40){kind=avatar}
0 commit comments