Syslog · Logstreem

Syslog

RFC 5424 over TLS, for appliances and hosts that only speak syslog.

For anything that cannot make an HTTPS request — network gear, legacy hosts — run the syslog proxy and let it translate.

docker run -d --name logstreem-syslog \
  -p 6514:6514/tcp \
  -e LOGSTREEM_TOKEN="$LOGSTREEM_TOKEN" \
  -e LOGSTREEM_DATASET="syslog-prod" \
  logstreem/syslog-proxy:1

Field mapping

Syslog	Becomes
`TIMESTAMP`	`_time`
`HOSTNAME`	`host`
`APP-NAME`	`service`
`SEVERITY`	`level`, mapped to `debug`/`info`/`warn`/`error`
`FACILITY`	`facility`
`STRUCTURED-DATA`	Flattened onto the event
`MSG`	`message`, parsed as JSON when it is JSON

Use TCP, not UDP

UDP syslog drops silently under load, and you find out during the incident the logs were meant to explain. The proxy listens on TCP+TLS at 6514 for exactly this reason.

PreviousVercel NextKafka