Syslog

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/syslog"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/16214b2b-c85c-4615-9a21-517520f8043a/social-card.svg?v=3e7ae33eec8b" alt="Syslog" width="600" height="315"></a>

Receive syslog (RFC 5424) with your own OpenTelemetry Collector (contrib) and forward to the gateway as OTLP logs. Point your devices at the collector host and port. Needs an ingestion key with ingest:logs; set WT_OTLP_ENDPOINT and WT_INGEST_KEY.

receivers:
  syslog:
    protocol: rfc5424
    tcp:
      listen_address: 0.0.0.0:54526
processors:
  batch: {}
exporters:
  otlphttp:
    endpoint: ${env:WT_OTLP_ENDPOINT}
    headers:
      Authorization: "Bearer ${env:WT_INGEST_KEY}"
service:
  pipelines:
    logs:
      receivers: [syslog]
      processors: [batch]
      exporters: [otlphttp]

For RFC 3164 devices use protocol: rfc3164. For UDP use udp: {listen_address: ...} instead of tcp. Expose the listener only on a trusted network: syslog itself carries no authentication.

Updated