Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.

Documentation Grafana Alloy Reference Components otelcol otelcol.exporter.syslog

otelcol.exporter.syslog

otelcol.exporter.syslog accepts logs from other otelcol components and writes them over the network using the syslog protocol. It supports syslog protocols RFC5424 and RFC3164 and can send data over TCP or UDP.

You can specify multiple otelcol.exporter.syslog components by giving them different labels.

Usage

Alloy Copy

otelcol.exporter.syslog "LABEL" {
  endpoint = "HOST"
}

Supported Attributes

The exporter creates one syslog message for each log record based on the following attributes of the log record. If an attribute is missing, the default value is used. The log’s timestamp field is used for the syslog message’s time. RFC3164 only supports a subset of the attributes supported by RFC5424, and the default values are not the same between the two protocols. Refer to the OpenTelemetry documentation for the exporter for more details.

Arguments

otelcol.exporter.syslog supports the following arguments:

The network argument specifies if the syslog endpoint is using the TCP or UDP protocol. network must be one of tcp, udp

The protocol argument specifies the syslog format supported by the endpoint. protocol must be one of rfc5424, rfc3164

Blocks

The following blocks are supported inside the definition of otelcol.exporter.syslog:

tls block

The tls block configures TLS settings used for a connection to a TCP syslog server.

sending_queue block

The sending_queue block configures an in-memory buffer of batches before data is sent to the syslog server.

retry_on_failure block

The retry_on_failure block configures how failed requests to the syslog server are retried.

debug_metrics block

Exported fields

The following fields are exported and can be referenced by other components:

input accepts otelcol.Consumer data for logs. Other telemetry signals are ignored.

Component health

otelcol.exporter.syslog is only reported as unhealthy if given an invalid configuration.

Debug information

otelcol.exporter.syslog doesn’t expose any component-specific debug information.

Examples

TCP endpoint without TLS

This example creates an exporter to send data to a syslog server expecting RFC5424-compliant messages over TCP without TLS:

Alloy Copy

otelcol.exporter.syslog "default" {
  endpoint = "localhost"
  tls {
      insecure             = true
      insecure_skip_verify = true
  }
}

Use the otelcol.processor.transform component to format logs from loki.source.syslog

This example shows one of the methods for annotating your loki messages into the format expected by the exporter using a otelcol.receiver.loki component in addition to the otelcol.processor.transform component. This example assumes that the log messages being parsed have come from a loki.source.syslog component. This is just an example of some of the techniques that can be applied, and not a fully functioning example for a specific incoming log.

Alloy Copy

otelcol.receiver.loki "default" {
  output {
    logs = [otelcol.processor.transform.syslog.input]
  }
}

otelcol.processor.transform "syslog" {
  error_mode = "ignore"

  log_statements {
    context = "log"

    statements = [
      `set(attributes["message"], attributes["__syslog_message"])`,
      `set(attributes["appname"], attributes["__syslog_appname"])`,
      `set(attributes["hostname"], attributes["__syslog_hostname"])`,

      // To set structured data you can chain index ([]) operations.
      `set(attributes["structured_data"]["auth@32473"]["user"], attributes["__syslog_message_sd_auth_32473_user"])`,
      `set(attributes["structured_data"]["auth@32473"]["user_host"], attributes["__syslog_message_sd_auth_32473_user_host"])`,
      `set(attributes["structured_data"]["auth@32473"]["valid"], attributes["__syslog_message_sd_auth_32473_authenticated"])`,
    ]
  }

  output {
    metrics = []
    logs    = [otelcol.exporter.syslog.default.input]
    traces  = []
  }
}

Use the otelcol.processor.transform component to format OpenTelemetry logs

This example shows one of the methods for annotating your messages in the OpenTelemetry log format into the format expected by the exporter using an otelcol.processor.transform component. This example assumes that the log messages being parsed have come from another OpenTelemetry receiver in JSON format (or have been transformed to OpenTelemetry logs using an otelcol.receiver.loki component). This is just an example of some of the techniques that can be applied, and not a fully functioning example for a specific incoming log format.

Alloy Copy

otelcol.processor.transform "syslog" {
  error_mode = "ignore"

  log_statements {
    context = "log"

    statements = [
      // Parse body as JSON and merge the resulting map with the cache map, ignoring non-json bodies.
      // cache is a field exposed by OTTL that is a temporary storage place for complex operations.
      `merge_maps(cache, ParseJSON(body), "upsert") where IsMatch(body, "^\\{")`,

      // Set some example syslog attributes using the values from a JSON message body
      // If the attribute doesn't exist in cache then nothing happens.
      `set(attributes["message"], cache["log"])`,
      `set(attributes["appname"], cache["application"])`,
      `set(attributes["hostname"], cache["source"])`,

      // To set structured data you can chain index ([]) operations.
      `set(attributes["structured_data"]["auth@32473"]["user"], attributes["user"])`,
      `set(attributes["structured_data"]["auth@32473"]["user_host"], cache["source"])`,
      `set(attributes["structured_data"]["auth@32473"]["valid"], cache["authenticated"])`,

      // Example priority setting, using facility 1 (user messages) and default to Info
      `set(attributes["priority"], 14)`,
      `set(attributes["priority"], 12) where severity_number == SEVERITY_NUMBER_WARN`,
      `set(attributes["priority"], 11) where severity_number == SEVERITY_NUMBER_ERROR`,
      `set(attributes["priority"], 10) where severity_number == SEVERITY_NUMBER_FATAL`,
    ]
  }

  output {
    metrics = []
    logs    = [otelcol.exporter.syslog.default.input]
    traces  = []
  }
}

Compatible components

otelcol.exporter.syslog has exports that can be consumed by the following components:

• Components that consume OpenTelemetry otelcol.Consumer