Syslog using OpenTelemetry
Syslog separates the software that emits a message from the system that stores it, labelling each message with a facility code and a severity level. When a source cannot be pointed at a custom endpoint, you need an intermediate server: an OpenTelemetry Collector that listens for syslog, parses it, and forwards it to Coralogix.
What you need
- A server to run OpenTelemetry on, with a static public IP for the initial configuration.
- A Coralogix Send-Your-Data API key.
- Your Coralogix domain.
Deploy the Collector
2.
Write the configuration
Create the Collector configuration file, substituting the values from the table below.
receivers:
syslog:
tcp:
listen_address: "0.0.0.0:514"
protocol: rfc5424
operators:
- type: syslog_parser
protocol: rfc5424
parse_from: body
parse_to: body
- type: remove
field: attributes
exporters:
coralogix:
domain: "eu2.coralogix.com"
private_key: "private_key"
application_name: "applicationName"
subsystem_name: "subsystemName"
timeout: 30s
service:
pipelines:
logs:
receivers: [ syslog ]
exporters: [ coralogix ]
| Value | What to enter |
|---|---|
application_name | Application name shown in your Coralogix dashboard |
subsystem_name | Subsystem name shown in your Coralogix dashboard |
domain | Your Coralogix domain |
private_key | Your Send-Your-Data API key |
protocol | The syslog message format your source sends. rfc3164 or rfc5424 |
3.
Save and start the Collector
Save the configuration file and start the Collector.
Note
Port 514 is the syslog default. If you listen on a different port, change listen_address to match and open that port on the server.
Related resources
Last updated on