Reference

Components

loki

loki.source.syslog

General availability (GA) Open source

`loki.source.syslog`

loki.source.syslog listens for syslog messages over TCP or UDP connections and forwards them to other loki.* components. The messages must be compliant with the RFC5424 syslog protocol or the RFC3164 BSD syslog protocol. For a detailed example, refer to the Monitor RFC5424-compliant syslog messages with Grafana Alloy scenario.

Note
If your messages aren’t RFC5424 compliant, you can use raw syslog format in combination with the loki.process component.
Please note, that the raw syslog format is an experimental feature.

The component starts a new syslog listener for each of the given config blocks and fans out incoming entries to the list of receivers in forward_to.

You can specify multiple loki.source.syslog components by giving them different labels.

Usage

loki.source.syslog "<LABEL>" {
  listener {
    address = "<LISTEN_ADDRESS>"
  }
  ...

  forward_to = <RECEIVER_LIST>
}

Arguments

You can use the following arguments with loki.source.syslog:

Name	Type	Description	Default	Required
`forward_to`	`list(LogsReceiver)`	List of receivers to send log entries to.		yes
`relabel_rules`	`RelabelRules`	Relabeling rules to apply on log entries.	`{}`	no

The relabel_rules field can make use of the rules export value from a loki.relabel component to apply one or more relabeling rules to log entries before they’re forwarded to the list of receivers in forward_to.

loki.source.syslog applies the following labels to log entries from the client information if possible.

__syslog_connection_ip_address
__syslog_connection_hostname

loki.source.syslog applies the following labels to log entries if they have been parsed from the syslog message.

__syslog_message_severity
__syslog_message_facility
__syslog_message_hostname
__syslog_message_app_name
__syslog_message_proc_id
__syslog_message_msg_id
__syslog_message_msg_counter
__syslog_message_sequence

If there is RFC5424 compliant structured data in the parsed message, it will be applied to the log entry as a label with prefix __syslog_message_sd_. For example, if the structured data provided is [example@99999 test="value"], the log entry will have the label __syslog_message_sd_example_99999_test with a value of value.

Before passing log entries to the next component in the pipeline, the syslog source will remove any labels with a __ prefix. To retain the __syslog_ labels on the log entries, you must use rules in the relabel_rules argument to move them to labels that do not have a __ prefix. The following relabel example retains all __syslog_ labels on the log entry when the entries are passed to the next component in the pipeline.

loki.relabel "syslog" {
  rule {
    action = "labelmap"
    regex = "__syslog_(.+)"
  }
}

Blocks

You can use the following blocks with loki.source.syslog:

Name	Description	Required
`listener`	Configures a listener for Syslog messages.	no
`listener` > `raw_format_options`	Configures `raw` syslog format behavior.	no
`listener` > `rfc3164_cisco_components`	Configures parsing of non-standard Cisco IOS syslog extensions.	no
`listener` > `tls_config`	Configures TLS settings for connecting to the endpoint for TCP connections.	no

The > symbol indicates deeper levels of nesting. For example, listener > tls_config refers to a tls_config block defined inside a listener block.

`listener`

The listener block defines the listen address and protocol where the listener expects syslog messages to be sent to, as well as its behavior when receiving messages.

The following arguments can be used to configure a listener. Only the address field is required and any omitted fields take their default values.

Name	Type	Description	Default	Required
`address`	`string`	The `<host:port>` address to listen to for syslog messages.		yes
`idle_timeout`	`duration`	The idle timeout for TCP connections.	`"120s"`	no
`label_structured_data`	`bool`	Whether to translate syslog structured data to Loki labels.	`false`	no
`labels`	`map(string)`	The labels to associate with each received syslog record.	`{}`	no
`max_message_length`	`int`	The maximum limit to the length of syslog messages.	`8192`	no
`protocol`	`string`	The protocol to listen to for syslog messages. Must be either `tcp` or `udp`.	`"tcp"`	no
`rfc3164_default_to_current_year`	`bool`	Whether to default the incoming timestamp of an `rfc3164` message to the current year.	`false`	no
`syslog_format`	`string`	The format for incoming messages. See supported formats.	`"rfc5424"`	no
`use_incoming_timestamp`	`bool`	Whether to set the timestamp to the incoming syslog record timestamp.	`false`	no
`use_rfc5424_message`	`bool`	Whether to forward the full RFC5424-formatted syslog message.	`false`	no

By default, the component assigns the log entry timestamp as the time it was processed.

The labels map is applied to every message that the component reads.

All header fields from the parsed RFC5424 messages are brought in as internal labels, prefixed with __syslog_.

If label_structured_data is set, structured data in the syslog header is also translated to internal labels in the form of __syslog_message_sd_<ID>_<KEY>. For example, a structured data entry of [example@99999 test="yes"] becomes the label __syslog_message_sd_example_99999_test with the value "yes".

The rfc3164_default_to_current_year argument is only relevant when use_incoming_timestamp is also set to true. rfc3164 message timestamps don’t contain a year, and this component’s default behavior is to mimic Promtail behavior and leave the year as 0. Setting rfc3164_default_to_current_year to true sets the year of the incoming timestamp to the current year using the local time of the Alloy instance.

Note
The rfc3164_default_to_current_year, use_incoming_timestamp and use_rfc5424_message fields cannot be used when syslog_format is set to raw.

Supported formats

rfc3164 A legacy syslog format, also known as BSD syslog. Example: <34>Oct 11 22:14:15 my-server-01 sshd[1234]: Failed password for root from 192.168.1.10 port 22 ssh2
rfc5424 A modern, structured syslog format. Uses ISO 8601 for timestamps. Example: <165>1 2025-12-18T00:33:00Z web01 nginx - - [audit@123 id="456"] Login failed.
raw Disables log line parsing. This format allows receiving non-RFC5424 compliant logs, such as CEF. Raw logs can be forwarded to loki.process component for parsing.

Note
The raw format is an experimental feature. Experimental features are subject to frequent breaking changes, and may be removed with no equivalent replacement. To enable and use an experimental feature, you must set the stability.level flag to experimental.

`raw_format_options`

EXPERIMENTAL: This is an experimental feature. Experimental features are subject to frequent breaking changes, and may be removed with no equivalent replacement. To enable and use an experimental feature, you must set the stability.level flag to experimental.

The raw_format_options block configures the raw syslog format behavior.

Note
This block can only be used when you set syslog_format to raw.

The following argument is supported:

Name	Type	Description	Default	Required
`use_null_terminator_delimiter`	`bool`	Use null-terminator (`\0`) instead of line break (`\n`) to split log lines.	`false`	no

`rfc3164_cisco_components`

EXPERIMENTAL: This is an experimental feature. Experimental features are subject to frequent breaking changes, and may be removed with no equivalent replacement. To enable and use an experimental feature, you must set the stability.level flag to experimental.

The rfc3164_cisco_components configures parsing of non-standard Cisco IOS syslog extensions.

Note
This block can only be used when you set syslog_format to rfc3164.

The following arguments are supported:

Name	Type	Description	Default	Required
`enable_all`	`bool`	Enables all components below.	`false`	no
`message_counter`	`bool`	Enables syslog message counter field parsing.	`false`	no
`sequence_number`	`bool`	Enables service sequence number field parsing.	`false`	no
`hostname`	`bool`	Enables origin hostname field parsing.	`false`	no
`second_fractions`	`bool`	Enables milliseconds parsing in timestamp field.	`false`	no

Note
At least one option has to be enabled if enable_all is set to false.

Caution
The rfc3164_cisco_components configuration must match your Cisco device configuration. The loki.source.syslog component cannot auto-detect which components are present because they share similar formats.

Cisco Device Configuration

conf t

! Enable message counter (on by default for remote logging)
logging host 10.0.0.10

! Add service sequence numbers
service sequence-numbers

! Add origin hostname
logging origin-id hostname

! Enable millisecond timestamps
service timestamps log datetime msec localtime

! Recommended: Enable NTP to remove asterisk
ntp server <your-ntp-server>

Current Limitations

Component Ordering: When Cisco components are selectively disabled on the device but the parser expects them, parsing will fail or produce incorrect results. Always match your parser configuration to your device configuration.
Structured Data: Messages with RFC5424-style structured data blocks (from logging host X session-id or sequence-num-session) are not currently supported. See the upstream issue for details.

`tls_config`

Name	Type	Description	Required
`ca_pem`	`string`	CA PEM-encoded text to validate the server with.	no
`ca_file`	`string`	CA certificate to validate the server with.	no
`cert_pem`	`string`	Certificate PEM-encoded text for client authentication.	no
`cert_file`	`string`	Certificate file for client authentication.	no
`insecure_skip_verify`	`bool`	Disables validation of the server certificate.	no
`key_file`	`string`	Key file for client authentication.	no
`key_pem`	`secret`	Key PEM-encoded text for client authentication.	no
`min_version`	`string`	Minimum acceptable TLS version.	no
`server_name`	`string`	ServerName extension to indicate the name of the server.	no

The following pairs of arguments are mutually exclusive and can’t both be set simultaneously:

ca_pem and ca_file
cert_pem and cert_file
key_pem and key_file

When configuring client authentication, both the client certificate (using cert_pem or cert_file) and the client key (using key_pem or key_file) must be provided.

When min_version isn’t provided, the minimum acceptable TLS version is inherited from Go’s default minimum version, TLS 1.2. If min_version is provided, it must be set to one of the following strings:

"TLS10" (TLS 1.0)
"TLS11" (TLS 1.1)
"TLS12" (TLS 1.2)
"TLS13" (TLS 1.3)

Exported fields

loki.source.syslog doesn’t export any fields.

Component health

loki.source.syslog is only reported as unhealthy if given an invalid configuration.

Debug information

loki.source.syslog exposes some debug information per syslog listener:

Whether the listener is running.
The listen address.
The labels that the listener applies to incoming log entries.

Debug metrics

loki_source_syslog_empty_messages_total (counter): Total number of empty messages received from the syslog component.
loki_source_syslog_entries_total (counter): Total number of successful entries sent to the syslog component.
loki_source_syslog_parsing_errors_total (counter): Total number of parsing errors while receiving syslog messages.

Example

This example listens for syslog messages in valid RFC5424 format over TCP and UDP in the specified ports and forwards them to a loki.write component.

loki.source.syslog "local" {
  listener {
    address  = "127.0.0.1:51893"
    labels   = { component = "loki.source.syslog", protocol = "tcp" }
  }

  listener {
    address  = "127.0.0.1:51898"
    protocol = "udp"
    labels   = { component = "loki.source.syslog", protocol = "udp"}
  }

  forward_to = [loki.write.local.receiver]
}

loki.write "local" {
  endpoint {
    url = "loki:3100/api/v1/push"
  }
}

Compatible components

loki.source.syslog can accept arguments from the following components:

Components that export Loki LogsReceiver

Note
Connecting some components may not be sensible or components may require further configuration to make the connection work correctly. Refer to the linked documentation for more details.

Was this page helpful?

Email docs@grafana.com

Help and support

Community