Documentation Grafana Alloy Reference Components otelcol otelcol.receiver.syslog

otelcol.receiver.syslog

otelcol.receiver.syslog accepts syslog messages over the network and forwards them as logs to other otelcol.* components. It supports syslog protocols RFC5424 and RFC3164 and can receive data over TCP or UDP.

You can specify multiple otelcol.receiver.syslog components by giving them different labels.

Usage

alloy Copy

otelcol.receiver.syslog "<LABEL>" {
  tcp { ... }
  udp { ... }

  output {
    logs    = [...]
  }
}

Arguments

You can use the following arguments with otelcol.receiver.syslog:

The protocol argument specifies the syslog format supported by the receiver. protocol must be one of rfc5424 or rfc3164

The location argument specifies a Time Zone identifier. The available locations depend on the local IANA Time Zone database. Refer to the list of tz database time zones in Wikipedia for a non-comprehensive list.

The non_transparent_framing_trailer and enable_octet_counting arguments specify TCP syslog behavior as defined in RFC6587. These arguments are mutually exclusive. They can’t be used with a UDP syslog listener configured. If configured, the non_transparent_framing_trailer argument must be one of LF, NUL.

The on_error argument can take the following values:

• drop: Drop the message.
• drop_quiet: Same as drop but logs are emitted at debug level.
• send: Send the message even if it failed to process. This may result in an error downstream.
• send_quiet: Same as send but logs are emitted at debug level.

Blocks

You can use the following blocks with otelcol.receiver.syslog:

The > symbol indicates deeper levels of nesting. For example, tcp > tls refers to a tls block defined inside a tcp block.

A syslog receiver must have either a udp or tcp block configured.

output

debug_metrics

retry_on_failure

The retry_on_failure block configures the retry behavior when the receiver encounters an error downstream in the pipeline. A backoff algorithm is used to delay the retry upon subsequent failures. The following arguments are supported:

If max_elapsed_time is set to 0, data will never be discarded.

tcp

The tcp block configures a TCP syslog server. The following arguments are supported:

The encoding argument specifies the encoding of the incoming syslog messages. encoding must be one of utf-8, utf-16le, utf-16be, ascii, big5, nop. Refer to the upstream receiver documentation for more details.

The max_log_size argument has a minimum value of 64KiB

multiline

The multiline block configures logic for splitting incoming log entries. The following arguments are supported:

A multiline block must contain either line_start_pattern or line_end_pattern.

If a multiline block isn’t set, log entries won’t be split.

tls

The tls block configures TLS settings used for a server. If the tls block isn’t provided, TLS won’t be used for connections to the server.

tpm

The tpm block configures retrieving the TLS key_file from a trusted device.

The following arguments are supported:

Name	Type	Description	Default	Required
auth	string	The authorization value used to authenticate the TPM device.	""	no
enabled	bool	Load the tls.key_file from TPM.	false	no
owner_auth	string	The owner authorization value used to authenticate the TPM device.	""	no
path	string	Path to the TPM device or Unix domain socket.	""	no

The trusted platform module (TPM) configuration can be used for loading TLS key from TPM. Currently only TSS2 format is supported.

The path attribute is not supported on Windows.

Example

alloy Copy

otelcol.example.component "<LABEL>" {
    ...
    tls {
        ...
        key_file = "my-tss2-key.key"
        tpm {
            enabled = true
            path = "/dev/tpmrm0"
        }
    }
}

In the above example, the private key my-tss2-key.key in TSS2 format will be loaded from the TPM device /dev/tmprm0.

udp

The udp block configures a UDP syslog server. The following arguments are supported:

The encoding argument specifies the encoding of the incoming syslog messages. encoding must be one of utf-8, utf-16le, utf-16be, ascii, big5, or nop. Refer to the upstream receiver documentation for more details.

async

The async block configures concurrent asynchronous readers for a UDP syslog server. The following arguments are supported:

If async isn’t set, a single goroutine will read and process messages synchronously.

Exported fields

otelcol.receiver.syslog doesn’t export any fields.

Component health

otelcol.receiver.syslog is only reported as unhealthy if given an invalid configuration.

Debug information

otelcol.receiver.syslog doesn’t expose any component-specific debug information.

Debug metrics

otelcol.receiver.syslog doesn’t expose any component-specific debug metrics.

Example

This example proxies syslog messages from the otelcol.receiver.syslog receiver to the otelcol.exporter.syslog component, and then sends them on to a loki.source.syslog component before being logged by a loki.echo component. This shows how the otelcol syslog components can be used to proxy syslog messages before sending them to another destination.

Using the otelcol syslog components in this way results in the messages being forwarded as sent, attempting to use the loki.source.syslog component for a similar proxy use case requires careful mapping of any structured data fields through the otelcol.processor.transform component. A very simple example of that can be found in the otelcol.exporter.syslog documentation.

alloy Copy

otelcol.receiver.syslog "default" {
    protocol = "rfc5424"
    tcp {
        listen_address = "localhost:1515"
    }
    output {
        logs = [otelcol.exporter.syslog.default.input]
    }
}

otelcol.exporter.syslog "default" {
    endpoint = "localhost"
    network = "tcp"
    port = 1514
    protocol = "rfc5424"
    enable_octet_counting = false
    tls {
        insecure = true
    }
}

loki.source.syslog "default" {
  listener {
    address = "localhost:1514"
    protocol = "tcp"
    syslog_format = "rfc5424"
    label_structured_data = true
    use_rfc5424_message = true
  }
  forward_to = [loki.echo.default.receiver]
}

loki.echo "default" {}

Compatible components

otelcol.receiver.syslog can accept arguments from the following components:

• Components that export OpenTelemetry otelcol.Consumer