Documentation > Log Collection > Syslog

Collecting logs from Syslog

Ingest logs via the Syslog protocol (RFC 5424) with TCP and UDP transport support. Compatible with rsyslog, syslog-ng, systemd-journald and any system that emits syslog messages.

/etc/rsyslog.d/logdoc.conf

# Forward all logs to LogDoc over TCP
*.* @@logdoc-server:1514;RSYSLOG_SyslogProtocol23Format

# Forward only critical and above
*.crit @@logdoc-server:1514;RSYSLOG_SyslogProtocol23Format

# Filter by program name
:programname, isequal, "nginx" @@logdoc-server:1514

syslog-ng.conf

destination d_logdoc {
  tcp("logdoc-server" port(1514));
};

log {
  source(s_sys);
  destination(d_logdoc);
};

Supported formats

•RFC 5424 (structured syslog) — full structured data parsing

•RFC 3164 (legacy BSD syslog) — backward compatibility with older systems

•TCP and UDP transport — choose reliability or speed depending on the task