[{"data":1,"prerenderedAt":4274},["ShallowReactive",2],{"\u002Fguides\u002Fopentelemetry-syslog-receiver-navigation":3,"\u002Fguides\u002Fopentelemetry-syslog-receiver":196,"$Vs9m8Q-E34":4177},[4,8,12,16,20,24,28,32,36,40,44,48,52,56,60,64,68,72,76,80,84,88,92,96,100,104,108,112,116,120,124,128,132,136,140,144,148,152,156,160,164,168,172,176,180,184,188,192],{"title":5,"path":6,"stem":7},"Guides","\u002Fguides","guides\u002Findex",{"title":9,"path":10,"stem":11},"OpenTelemetry Beego monitoring [otelbeego]","\u002Fguides\u002Fopentelemetry-beego","guides\u002Fopentelemetry-beego",{"title":13,"path":14,"stem":15},"OpenTelemetry Celery Instrumentation Guide","\u002Fguides\u002Fopentelemetry-celery","guides\u002Fopentelemetry-celery",{"title":17,"path":18,"stem":19},"Instrumenting Go database\u002Fsql with OpenTelemetry [otelsql]","\u002Fguides\u002Fopentelemetry-database-sql","guides\u002Fopentelemetry-database-sql",{"title":21,"path":22,"stem":23},"Django OpenTelemetry Instrumentation and Monitoring","\u002Fguides\u002Fopentelemetry-django","guides\u002Fopentelemetry-django",{"title":25,"path":26,"stem":27},"OpenTelemetry Docker Monitoring with Collector and Docker Stats","\u002Fguides\u002Fopentelemetry-docker","guides\u002Fopentelemetry-docker",{"title":29,"path":30,"stem":31},"OpenTelemetry Echo by Labstack [otelecho]","\u002Fguides\u002Fopentelemetry-echo","guides\u002Fopentelemetry-echo",{"title":33,"path":34,"stem":35},"OpenTelemetry Go Ent monitoring [otelent]","\u002Fguides\u002Fopentelemetry-ent","guides\u002Fopentelemetry-ent",{"title":37,"path":38,"stem":39},"OpenTelemetry Express.js instrumentation","\u002Fguides\u002Fopentelemetry-express","guides\u002Fopentelemetry-express",{"title":41,"path":42,"stem":43},"OpenTelemetry Falcon Instrumentation and Monitoring","\u002Fguides\u002Fopentelemetry-falcon","guides\u002Fopentelemetry-falcon",{"title":45,"path":46,"stem":47},"OpenTelemetry FastAPI Instrumentation and Monitoring","\u002Fguides\u002Fopentelemetry-fastapi","guides\u002Fopentelemetry-fastapi",{"title":49,"path":50,"stem":51},"OpenTelemetry Filelog Receiver","\u002Fguides\u002Fopentelemetry-filelog-receiver","guides\u002Fopentelemetry-filelog-receiver",{"title":53,"path":54,"stem":55},"OpenTelemetry Flask Instrumentation and Monitoring","\u002Fguides\u002Fopentelemetry-flask","guides\u002Fopentelemetry-flask",{"title":57,"path":58,"stem":59},"OpenTelemetry Gin Monitoring [otelgin]","\u002Fguides\u002Fopentelemetry-gin","guides\u002Fopentelemetry-gin",{"title":61,"path":62,"stem":63},"OpenTelemetry Golang gRPC monitoring [otelgrpc]","\u002Fguides\u002Fopentelemetry-go-grpc","guides\u002Fopentelemetry-go-grpc",{"title":65,"path":66,"stem":67},"OpenTelemetry Go AWS Lambda Instrumentation","\u002Fguides\u002Fopentelemetry-go-lambda","guides\u002Fopentelemetry-go-lambda",{"title":69,"path":70,"stem":71},"OpenTelemetry Go-Zero monitoring [otelzero]","\u002Fguides\u002Fopentelemetry-go-zero","guides\u002Fopentelemetry-go-zero",{"title":73,"path":74,"stem":75},"OpenTelemetry Gorilla Mux monitoring [otelmux]","\u002Fguides\u002Fopentelemetry-gorilla-mux","guides\u002Fopentelemetry-gorilla-mux",{"title":77,"path":78,"stem":79},"OpenTelemetry GORM monitoring [otelgorm]","\u002Fguides\u002Fopentelemetry-gorm","guides\u002Fopentelemetry-gorm",{"title":81,"path":82,"stem":83},"OpenTelemetry HTTPcheck Receiver","\u002Fguides\u002Fopentelemetry-httpcheck","guides\u002Fopentelemetry-httpcheck",{"title":85,"path":86,"stem":87},"OpenTelemetry Kubernetes Events Receiver [k8seventsreceiver]","\u002Fguides\u002Fopentelemetry-k8seventsreceiver","guides\u002Fopentelemetry-k8seventsreceiver",{"title":89,"path":90,"stem":91},"Kafka Monitoring with OpenTelemetry Collector","\u002Fguides\u002Fopentelemetry-kafka","guides\u002Fopentelemetry-kafka",{"title":93,"path":94,"stem":95},"OpenTelemetry Integration for Laravel: Full Guide","\u002Fguides\u002Fopentelemetry-laravel","guides\u002Fopentelemetry-laravel",{"title":97,"path":98,"stem":99},"OpenTelemetry Log4j logs [Java]","\u002Fguides\u002Fopentelemetry-log4j","guides\u002Fopentelemetry-log4j",{"title":101,"path":102,"stem":103},"OpenTelemetry Logback logging [Java]","\u002Fguides\u002Fopentelemetry-logback","guides\u002Fopentelemetry-logback",{"title":105,"path":106,"stem":107},"OpenTelemetry Logrus logs [otellogrus]","\u002Fguides\u002Fopentelemetry-logrus","guides\u002Fopentelemetry-logrus",{"title":109,"path":110,"stem":111},"OpenTelemetry MySQL Monitoring [step by step]","\u002Fguides\u002Fopentelemetry-mysql","guides\u002Fopentelemetry-mysql",{"title":113,"path":114,"stem":115},"OpenTelemetry Go net\u002Fhttp Instrumentation [otelhttp]","\u002Fguides\u002Fopentelemetry-net-http","guides\u002Fopentelemetry-net-http",{"title":117,"path":118,"stem":119},"OpenTelemetry Next.js Instrumentation","\u002Fguides\u002Fopentelemetry-nextjs","guides\u002Fopentelemetry-nextjs",{"title":121,"path":122,"stem":123},"OpenTelemetry NGINX Instrumentation","\u002Fguides\u002Fopentelemetry-nginx","guides\u002Fopentelemetry-nginx",{"title":125,"path":126,"stem":127},"OpenTelemetry Node.js AWS Lambda","\u002Fguides\u002Fopentelemetry-node-lambda","guides\u002Fopentelemetry-node-lambda",{"title":129,"path":130,"stem":131},"OpenTelemetry Phoenix monitoring","\u002Fguides\u002Fopentelemetry-phoenix","guides\u002Fopentelemetry-phoenix",{"title":133,"path":134,"stem":135},"PHP-FPM Monitoring with OpenTelemetry: Metrics, Alerts, and Dashboards","\u002Fguides\u002Fopentelemetry-php-fpm","guides\u002Fopentelemetry-php-fpm",{"title":137,"path":138,"stem":139},"OpenTelemetry PostgreSQL Monitoring","\u002Fguides\u002Fopentelemetry-postgresql","guides\u002Fopentelemetry-postgresql",{"title":141,"path":142,"stem":143},"OpenTelemetry Pyramid: Instrumentation and Monitoring Guide","\u002Fguides\u002Fopentelemetry-pyramid","guides\u002Fopentelemetry-pyramid",{"title":145,"path":146,"stem":147},"OpenTelemetry Quarkus Instrumentation [Java]","\u002Fguides\u002Fopentelemetry-quarkus","guides\u002Fopentelemetry-quarkus",{"title":149,"path":150,"stem":151},"OpenTelemetry RabbitMQ Monitoring Guide","\u002Fguides\u002Fopentelemetry-rabbitmq","guides\u002Fopentelemetry-rabbitmq",{"title":153,"path":154,"stem":155},"Ruby on Rails Application Monitoring with OpenTelemetry","\u002Fguides\u002Fopentelemetry-rails","guides\u002Fopentelemetry-rails",{"title":157,"path":158,"stem":159},"Monitor Redis with OpenTelemetry Collector","\u002Fguides\u002Fopentelemetry-redis","guides\u002Fopentelemetry-redis",{"title":161,"path":162,"stem":163},"OpenTelemetry Sinatra monitoring","\u002Fguides\u002Fopentelemetry-sinatra","guides\u002Fopentelemetry-sinatra",{"title":165,"path":166,"stem":167},"OpenTelemetry Slim Framework: Instrumentation and Monitoring Guide","\u002Fguides\u002Fopentelemetry-slim","guides\u002Fopentelemetry-slim",{"title":169,"path":170,"stem":171},"OpenTelemetry Slog [otelslog]: Golang Bridge Setup & Examples","\u002Fguides\u002Fopentelemetry-slog","guides\u002Fopentelemetry-slog",{"title":173,"path":174,"stem":175},"OpenTelemetry for Spring Boot: Guide with Examples","\u002Fguides\u002Fopentelemetry-spring-boot","guides\u002Fopentelemetry-spring-boot",{"title":177,"path":178,"stem":179},"OpenTelemetry SQLAlchemy monitoring","\u002Fguides\u002Fopentelemetry-sqlalchemy","guides\u002Fopentelemetry-sqlalchemy",{"title":181,"path":182,"stem":183},"OpenTelemetry Integration for Symfony: Full Guide","\u002Fguides\u002Fopentelemetry-symfony","guides\u002Fopentelemetry-symfony",{"title":185,"path":186,"stem":187},"OpenTelemetry Syslog Receiver","\u002Fguides\u002Fopentelemetry-syslog-receiver","guides\u002Fopentelemetry-syslog-receiver",{"title":189,"path":190,"stem":191},"OpenTelemetry Tomcat: Instrumentation and Monitoring Guide","\u002Fguides\u002Fopentelemetry-tomcat","guides\u002Fopentelemetry-tomcat",{"title":193,"path":194,"stem":195},"OpenTelemetry Zap [otelzap]: Golang Logging Bridge Setup & Examples","\u002Fguides\u002Fopentelemetry-zap","guides\u002Fopentelemetry-zap",{"page":197,"surround":4172},{"id":198,"title":185,"author":199,"author_site":200,"body":201,"date":4159,"description":4160,"extension":4161,"image":4162,"meta":4163,"navigation":705,"path":186,"seo":4170,"stem":187,"__hash__":4171},"guides\u002Fguides\u002Fopentelemetry-syslog-receiver.md","abandurchin",null,{"type":202,"value":203,"toc":4104},"minimark",[204,226,234,237,242,251,256,267,280,285,302,307,355,359,362,367,370,378,381,462,472,476,479,485,487,600,603,607,620,634,637,810,815,826,833,864,868,872,875,929,933,936,985,998,1002,1005,1085,1088,1092,1095,1099,1110,1116,1119,1192,1195,1214,1218,1221,1227,1234,1238,1244,1248,1251,1254,1260,1266,1270,1276,1282,1289,1292,1308,1312,1318,1322,1329,1416,1420,1423,1523,1527,1530,1562,1565,1634,1638,1649,1727,1731,1738,1742,1745,2018,2021,2233,2236,2242,2246,2250,2348,2352,2355,2464,2467,2473,2477,2480,2748,2759,2763,2767,2772,2817,2822,2887,2892,2944,2949,3020,3046,3050,3059,3065,3070,3104,3113,3117,3122,3163,3168,3189,3192,3206,3210,3215,3271,3276,3282,3286,3290,3293,3386,3391,3409,3413,3426,3429,3459,3463,3778,3782,3785,3789,3828,3832,3875,3879,3922,3926,3968,3972,4030,4043,4047,4050,4053,4100],[205,206,207],"blockquote",{},[208,209,210,211,215,216,221,222],"p",{},"📋 ",[212,213,214],"strong",{},"Part of the OpenTelemetry ecosystem:"," The Syslog Receiver is a component of the ",[217,218,220],"a",{"href":219},"\u002Fopentelemetry\u002Fcollector","OpenTelemetry Collector"," that ingests syslog messages over the network and converts them into structured OpenTelemetry log records. New to OpenTelemetry? Start with ",[217,223,225],{"href":224},"\u002Fopentelemetry","What is OpenTelemetry?",[208,227,228,229,233],{},"Linux servers, network devices, and applications have used syslog as the standard logging protocol for decades. The OpenTelemetry Syslog Receiver bridges that legacy infrastructure with modern observability — receiving syslog messages over TCP or UDP and converting them into vendor-neutral ",[217,230,232],{"href":231},"\u002Fopentelemetry\u002Flogs","OpenTelemetry log records",".",[208,235,236],{},"This guide takes you from a basic syslog listener to a production-grade pipeline with rsyslog\u002Fsyslog-ng forwarding, TLS encryption, and Kubernetes integration.",[238,239,241],"h2",{"id":240},"what-is-the-syslog-receiver","What is the Syslog Receiver?",[208,243,244,245,250],{},"The Syslog Receiver opens a TCP or UDP port, receives incoming syslog messages, parses their structured fields, and emits ",[217,246,232],{"href":247,"rel":248},"https:\u002F\u002Fopentelemetry.io\u002Fdocs\u002Fspecs\u002Fotel\u002Flogs\u002Fdata-model\u002F",[249],"nofollow",". It's part of the OpenTelemetry Collector Contrib distribution.",[208,252,253],{},[212,254,255],{},"Why use it instead of tailing log files?",[208,257,258,259,262,263,266],{},"Unlike the ",[217,260,261],{"href":50},"Filelog Receiver"," (which reads files from disk), the Syslog Receiver is ",[212,264,265],{},"push-based",": your systems actively forward logs to the Collector. This is ideal when:",[268,269,270,274,277],"ul",{},[271,272,273],"li",{},"You can't mount or access log files directly (network devices, remote servers)",[271,275,276],{},"You already have rsyslog or syslog-ng configured",[271,278,279],{},"You want centralized collection from many hosts without deploying agents everywhere",[208,281,282],{},[212,283,284],{},"Core capabilities:",[268,286,287,290,293,296,299],{},[271,288,289],{},"Listens for syslog messages on TCP or UDP",[271,291,292],{},"Parses RFC 3164 (BSD) and RFC 5424 (IETF) protocols",[271,294,295],{},"Automatically extracts timestamp, severity, facility, hostname, app name",[271,297,298],{},"Supports TLS for encrypted transport",[271,300,301],{},"Works with rsyslog, syslog-ng, and any RFC-compliant syslog sender",[208,303,304],{},[212,305,306],{},"How it works:",[308,309,314],"pre",{"className":310,"code":311,"language":312,"meta":313,"style":313},"language-mermaid shiki shiki-themes github-light","flowchart LR\n  A[rsyslog \u002F syslog-ng \u002F app] -->|TCP or UDP| B[Syslog Receiver]\n  B --> C[Parse Fields]\n  C --> D[Emit Log Records]\n  D --> E[Collector Pipeline]\n  E --> F[(Backend)]\n","mermaid","",[315,316,317,325,331,337,343,349],"code",{"__ignoreMap":313},[318,319,322],"span",{"class":320,"line":321},"line",1,[318,323,324],{},"flowchart LR\n",[318,326,328],{"class":320,"line":327},2,[318,329,330],{},"  A[rsyslog \u002F syslog-ng \u002F app] -->|TCP or UDP| B[Syslog Receiver]\n",[318,332,334],{"class":320,"line":333},3,[318,335,336],{},"  B --> C[Parse Fields]\n",[318,338,340],{"class":320,"line":339},4,[318,341,342],{},"  C --> D[Emit Log Records]\n",[318,344,346],{"class":320,"line":345},5,[318,347,348],{},"  D --> E[Collector Pipeline]\n",[318,350,352],{"class":320,"line":351},6,[318,353,354],{},"  E --> F[(Backend)]\n",[238,356,358],{"id":357},"syslog-protocol-formats","Syslog Protocol Formats",[208,360,361],{},"The Syslog Receiver supports two protocol versions. Choose based on what your systems send.",[363,364,366],"h3",{"id":365},"rfc-3164-bsd-syslog","RFC 3164 — BSD Syslog",[208,368,369],{},"The original syslog format, used by older Linux systems and most network equipment (routers, switches, firewalls):",[308,371,376],{"className":372,"code":374,"language":375},[373],"language-text","\u003C34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on \u002Fdev\u002Fpts\u002F8\n","text",[315,377,374],{"__ignoreMap":313},[208,379,380],{},"Fields extracted automatically:",[382,383,384,397],"table",{},[385,386,387],"thead",{},[388,389,390,394],"tr",{},[391,392,393],"th",{},"Field",[391,395,396],{},"Example Value",[398,399,400,414,426,438,450],"tbody",{},[388,401,402,408],{},[403,404,405],"td",{},[212,406,407],{},"priority",[403,409,410,413],{},[315,411,412],{},"34"," (facility × 8 + severity)",[388,415,416,421],{},[403,417,418],{},[212,419,420],{},"timestamp",[403,422,423],{},[315,424,425],{},"Oct 11 22:14:15",[388,427,428,433],{},[403,429,430],{},[212,431,432],{},"hostname",[403,434,435],{},[315,436,437],{},"mymachine",[388,439,440,445],{},[403,441,442],{},[212,443,444],{},"appname",[403,446,447],{},[315,448,449],{},"su",[388,451,452,457],{},[403,453,454],{},[212,455,456],{},"message",[403,458,459],{},[315,460,461],{},"'su root' failed for lonvick...",[208,463,464,467,468,471],{},[212,465,466],{},"Limitation:"," RFC 3164 timestamps have no year and no timezone — the receiver uses the ",[315,469,470],{},"location"," setting to interpret them.",[363,473,475],{"id":474},"rfc-5424-ietf-syslog","RFC 5424 — IETF Syslog",[208,477,478],{},"The modern format with structured data, timezone, and message ID:",[308,480,483],{"className":481,"code":482,"language":375},[373],"\u003C34>1 2026-04-05T14:30:00.000Z mymachine su 1234 ID47 [exampleSDID@32473 iut=\"3\"] Auth failure\n",[315,484,482],{"__ignoreMap":313},[208,486,380],{},[382,488,489,497],{},[385,490,491],{},[388,492,493,495],{},[391,494,393],{},[391,496,396],{},[398,498,499,509,521,533,543,553,565,577,589],{},[388,500,501,505],{},[403,502,503],{},[212,504,407],{},[403,506,507],{},[315,508,412],{},[388,510,511,516],{},[403,512,513],{},[212,514,515],{},"version",[403,517,518],{},[315,519,520],{},"1",[388,522,523,527],{},[403,524,525],{},[212,526,420],{},[403,528,529,532],{},[315,530,531],{},"2026-04-05T14:30:00.000Z"," (ISO 8601 with TZ)",[388,534,535,539],{},[403,536,537],{},[212,538,432],{},[403,540,541],{},[315,542,437],{},[388,544,545,549],{},[403,546,547],{},[212,548,444],{},[403,550,551],{},[315,552,449],{},[388,554,555,560],{},[403,556,557],{},[212,558,559],{},"proc_id",[403,561,562],{},[315,563,564],{},"1234",[388,566,567,572],{},[403,568,569],{},[212,570,571],{},"msg_id",[403,573,574],{},[315,575,576],{},"ID47",[388,578,579,584],{},[403,580,581],{},[212,582,583],{},"structured_data",[403,585,586],{},[315,587,588],{},"[exampleSDID@32473 iut=\"3\"]",[388,590,591,595],{},[403,592,593],{},[212,594,456],{},[403,596,597],{},[315,598,599],{},"Auth failure",[208,601,602],{},"RFC 5424 is preferred for new deployments — it's unambiguous and carries more context.",[238,604,606],{"id":605},"quick-start","Quick Start",[205,608,609],{},[208,610,611,612,615,616,233],{},"📚 ",[212,613,614],{},"Prerequisites",": This guide assumes you have the OpenTelemetry Collector installed. Need help? See our ",[217,617,619],{"href":618},"\u002Fopentelemetry\u002Fcollector#installation","Collector installation guide",[205,621,622],{},[208,623,624,625,628,629,633],{},"💡 ",[212,626,627],{},"Backend Configuration:"," Examples in this guide use Uptrace as the observability backend. OpenTelemetry is vendor-neutral — you can send logs to Grafana Cloud, Datadog, Elasticsearch, or any OTLP-compatible platform. See ",[217,630,632],{"href":631},"#backend-examples","backend examples"," at the end of this guide.",[208,635,636],{},"The minimal configuration listens on TCP port 54527 for RFC 3164 messages:",[308,638,642],{"className":639,"code":640,"language":641,"meta":313,"style":313},"language-yaml shiki shiki-themes github-light","receivers:\n  syslog:\n    tcp:\n      listen_address: '0.0.0.0:54527'\n    protocol: rfc3164\n    location: UTC\n\nexporters:\n  otlp\u002Fuptrace:\n    endpoint: api.uptrace.dev:4317\n    headers:\n      uptrace-dsn: 'https:\u002F\u002F\u003Csecret>@api.uptrace.dev?grpc=4317'\n\nservice:\n  pipelines:\n    logs:\n      receivers: [syslog]\n      exporters: [otlp\u002Fuptrace]\n","yaml",[315,643,644,654,661,668,680,690,700,707,715,723,734,742,753,758,766,774,782,797],{"__ignoreMap":313},[318,645,646,650],{"class":320,"line":321},[318,647,649],{"class":648},"shJU0","receivers",[318,651,653],{"class":652},"sgsFI",":\n",[318,655,656,659],{"class":320,"line":327},[318,657,658],{"class":648},"  syslog",[318,660,653],{"class":652},[318,662,663,666],{"class":320,"line":333},[318,664,665],{"class":648},"    tcp",[318,667,653],{"class":652},[318,669,670,673,676],{"class":320,"line":339},[318,671,672],{"class":648},"      listen_address",[318,674,675],{"class":652},": ",[318,677,679],{"class":678},"sYBdl","'0.0.0.0:54527'\n",[318,681,682,685,687],{"class":320,"line":345},[318,683,684],{"class":648},"    protocol",[318,686,675],{"class":652},[318,688,689],{"class":678},"rfc3164\n",[318,691,692,695,697],{"class":320,"line":351},[318,693,694],{"class":648},"    location",[318,696,675],{"class":652},[318,698,699],{"class":678},"UTC\n",[318,701,703],{"class":320,"line":702},7,[318,704,706],{"emptyLinePlaceholder":705},true,"\n",[318,708,710,713],{"class":320,"line":709},8,[318,711,712],{"class":648},"exporters",[318,714,653],{"class":652},[318,716,718,721],{"class":320,"line":717},9,[318,719,720],{"class":648},"  otlp\u002Fuptrace",[318,722,653],{"class":652},[318,724,726,729,731],{"class":320,"line":725},10,[318,727,728],{"class":648},"    endpoint",[318,730,675],{"class":652},[318,732,733],{"class":678},"api.uptrace.dev:4317\n",[318,735,737,740],{"class":320,"line":736},11,[318,738,739],{"class":648},"    headers",[318,741,653],{"class":652},[318,743,745,748,750],{"class":320,"line":744},12,[318,746,747],{"class":648},"      uptrace-dsn",[318,749,675],{"class":652},[318,751,752],{"class":678},"'https:\u002F\u002F\u003Csecret>@api.uptrace.dev?grpc=4317'\n",[318,754,756],{"class":320,"line":755},13,[318,757,706],{"emptyLinePlaceholder":705},[318,759,761,764],{"class":320,"line":760},14,[318,762,763],{"class":648},"service",[318,765,653],{"class":652},[318,767,769,772],{"class":320,"line":768},15,[318,770,771],{"class":648},"  pipelines",[318,773,653],{"class":652},[318,775,777,780],{"class":320,"line":776},16,[318,778,779],{"class":648},"    logs",[318,781,653],{"class":652},[318,783,785,788,791,794],{"class":320,"line":784},17,[318,786,787],{"class":648},"      receivers",[318,789,790],{"class":652},": [",[318,792,793],{"class":678},"syslog",[318,795,796],{"class":652},"]\n",[318,798,800,803,805,808],{"class":320,"line":799},18,[318,801,802],{"class":648},"      exporters",[318,804,790],{"class":652},[318,806,807],{"class":678},"otlp\u002Fuptrace",[318,809,796],{"class":652},[208,811,812],{},[212,813,814],{},"What happens:",[268,816,817,820,823],{},[271,818,819],{},"Collector opens port 54527 and waits for incoming syslog messages",[271,821,822],{},"Each received message is parsed into structured fields",[271,824,825],{},"Parsed log records are forwarded to your backend",[208,827,828,829,832],{},"Test it immediately with ",[315,830,831],{},"logger",":",[308,834,838],{"className":835,"code":836,"language":837,"meta":313,"style":313},"language-bash shiki shiki-themes github-light","logger -n 127.0.0.1 -P 54527 --tcp \"Test message from syslog\"\n","bash",[315,839,840],{"__ignoreMap":313},[318,841,842,845,849,852,855,858,861],{"class":320,"line":321},[318,843,831],{"class":844},"s7eDp",[318,846,848],{"class":847},"sYu0t"," -n",[318,850,851],{"class":847}," 127.0.0.1",[318,853,854],{"class":847}," -P",[318,856,857],{"class":847}," 54527",[318,859,860],{"class":847}," --tcp",[318,862,863],{"class":678}," \"Test message from syslog\"\n",[238,865,867],{"id":866},"tcp-vs-udp-transport","TCP vs UDP Transport",[363,869,871],{"id":870},"tcp-recommended","TCP (Recommended)",[208,873,874],{},"TCP guarantees delivery — if the Collector is temporarily unavailable, rsyslog\u002Fsyslog-ng will buffer messages and retry:",[308,876,878],{"className":639,"code":877,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    tcp:\n      listen_address: '0.0.0.0:54527'\n      max_log_size: 1MiB        # Max size per message\n    protocol: rfc5424\n",[315,879,880,886,892,898,906,920],{"__ignoreMap":313},[318,881,882,884],{"class":320,"line":321},[318,883,649],{"class":648},[318,885,653],{"class":652},[318,887,888,890],{"class":320,"line":327},[318,889,658],{"class":648},[318,891,653],{"class":652},[318,893,894,896],{"class":320,"line":333},[318,895,665],{"class":648},[318,897,653],{"class":652},[318,899,900,902,904],{"class":320,"line":339},[318,901,672],{"class":648},[318,903,675],{"class":652},[318,905,679],{"class":678},[318,907,908,911,913,916],{"class":320,"line":345},[318,909,910],{"class":648},"      max_log_size",[318,912,675],{"class":652},[318,914,915],{"class":678},"1MiB",[318,917,919],{"class":918},"sAwPA","        # Max size per message\n",[318,921,922,924,926],{"class":320,"line":351},[318,923,684],{"class":648},[318,925,675],{"class":652},[318,927,928],{"class":678},"rfc5424\n",[363,930,932],{"id":931},"udp","UDP",[208,934,935],{},"UDP is simpler and lower overhead, but messages are lost if the Collector is down. Use for high-volume, low-criticality logs:",[308,937,939],{"className":639,"code":938,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    udp:\n      listen_address: '0.0.0.0:514'\n    protocol: rfc3164\n    location: UTC\n",[315,940,941,947,953,960,969,977],{"__ignoreMap":313},[318,942,943,945],{"class":320,"line":321},[318,944,649],{"class":648},[318,946,653],{"class":652},[318,948,949,951],{"class":320,"line":327},[318,950,658],{"class":648},[318,952,653],{"class":652},[318,954,955,958],{"class":320,"line":333},[318,956,957],{"class":648},"    udp",[318,959,653],{"class":652},[318,961,962,964,966],{"class":320,"line":339},[318,963,672],{"class":648},[318,965,675],{"class":652},[318,967,968],{"class":678},"'0.0.0.0:514'\n",[318,970,971,973,975],{"class":320,"line":345},[318,972,684],{"class":648},[318,974,675],{"class":652},[318,976,689],{"class":678},[318,978,979,981,983],{"class":320,"line":351},[318,980,694],{"class":648},[318,982,675],{"class":652},[318,984,699],{"class":678},[205,986,987],{},[208,988,989,990,993,994,997],{},"⚠️ ",[212,991,992],{},"Port 514",": Binding to ports below 1024 requires root or ",[315,995,996],{},"CAP_NET_BIND_SERVICE",". For non-root deployments, use ports ≥ 1024 (e.g. 54527) and have rsyslog forward there.",[363,999,1001],{"id":1000},"tcp-tls","TCP + TLS",[208,1003,1004],{},"For secure transport between hosts or across networks:",[308,1006,1008],{"className":639,"code":1007,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    tcp:\n      listen_address: '0.0.0.0:6514'\n      tls:\n        cert_file: \u002Fetc\u002Fotelcol\u002Fserver.crt\n        key_file: \u002Fetc\u002Fotelcol\u002Fserver.key\n        ca_file: \u002Fetc\u002Fotelcol\u002Fca.crt   # For mutual TLS (optional)\n    protocol: rfc5424\n",[315,1009,1010,1016,1022,1028,1037,1044,1054,1064,1077],{"__ignoreMap":313},[318,1011,1012,1014],{"class":320,"line":321},[318,1013,649],{"class":648},[318,1015,653],{"class":652},[318,1017,1018,1020],{"class":320,"line":327},[318,1019,658],{"class":648},[318,1021,653],{"class":652},[318,1023,1024,1026],{"class":320,"line":333},[318,1025,665],{"class":648},[318,1027,653],{"class":652},[318,1029,1030,1032,1034],{"class":320,"line":339},[318,1031,672],{"class":648},[318,1033,675],{"class":652},[318,1035,1036],{"class":678},"'0.0.0.0:6514'\n",[318,1038,1039,1042],{"class":320,"line":345},[318,1040,1041],{"class":648},"      tls",[318,1043,653],{"class":652},[318,1045,1046,1049,1051],{"class":320,"line":351},[318,1047,1048],{"class":648},"        cert_file",[318,1050,675],{"class":652},[318,1052,1053],{"class":678},"\u002Fetc\u002Fotelcol\u002Fserver.crt\n",[318,1055,1056,1059,1061],{"class":320,"line":702},[318,1057,1058],{"class":648},"        key_file",[318,1060,675],{"class":652},[318,1062,1063],{"class":678},"\u002Fetc\u002Fotelcol\u002Fserver.key\n",[318,1065,1066,1069,1071,1074],{"class":320,"line":709},[318,1067,1068],{"class":648},"        ca_file",[318,1070,675],{"class":652},[318,1072,1073],{"class":678},"\u002Fetc\u002Fotelcol\u002Fca.crt",[318,1075,1076],{"class":918},"   # For mutual TLS (optional)\n",[318,1078,1079,1081,1083],{"class":320,"line":717},[318,1080,684],{"class":648},[318,1082,675],{"class":652},[318,1084,928],{"class":678},[208,1086,1087],{},"Standard TLS syslog port is 6514. Most syslog clients support it natively.",[238,1089,1091],{"id":1090},"forwarding-from-rsyslog","Forwarding from rsyslog",[208,1093,1094],{},"rsyslog is the default syslog daemon on most Linux distributions (Debian, Ubuntu, RHEL, CentOS).",[363,1096,1098],{"id":1097},"basic-tcp-forwarding","Basic TCP Forwarding",[208,1100,1101,1102,1105,1106,1109],{},"Add to the end of ",[315,1103,1104],{},"\u002Fetc\u002Frsyslog.conf"," (or create ",[315,1107,1108],{},"\u002Fetc\u002Frsyslog.d\u002Fotel.conf","):",[308,1111,1114],{"className":1112,"code":1113,"language":375},[373],"# Forward all logs to OpenTelemetry Collector over TCP\n*.* action(type=\"omfwd\"\n          target=\"127.0.0.1\"\n          port=\"54527\"\n          protocol=\"tcp\"\n          action.resumeRetryCount=\"10\"\n          queue.type=\"linkedList\"\n          queue.size=\"10000\")\n",[315,1115,1113],{"__ignoreMap":313},[208,1117,1118],{},"Key options:",[382,1120,1121,1131],{},[385,1122,1123],{},[388,1124,1125,1128],{},[391,1126,1127],{},"Option",[391,1129,1130],{},"Description",[398,1132,1133,1147,1162,1172,1182],{},[388,1134,1135,1140],{},[403,1136,1137],{},[315,1138,1139],{},"target",[403,1141,1142,1143,1146],{},"Collector host (use ",[315,1144,1145],{},"127.0.0.1"," for local, IP\u002Fhostname for remote)",[388,1148,1149,1154],{},[403,1150,1151],{},[315,1152,1153],{},"protocol",[403,1155,1156,1159,1160],{},[315,1157,1158],{},"tcp"," or ",[315,1161,931],{},[388,1163,1164,1169],{},[403,1165,1166],{},[315,1167,1168],{},"action.resumeRetryCount",[403,1170,1171],{},"Retries if Collector is unreachable",[388,1173,1174,1179],{},[403,1175,1176],{},[315,1177,1178],{},"queue.type=\"linkedList\"",[403,1180,1181],{},"In-memory buffer to avoid data loss",[388,1183,1184,1189],{},[403,1185,1186],{},[315,1187,1188],{},"queue.size",[403,1190,1191],{},"Max buffered messages",[208,1193,1194],{},"Restart rsyslog after changes:",[308,1196,1198],{"className":835,"code":1197,"language":837,"meta":313,"style":313},"sudo systemctl restart rsyslog\n",[315,1199,1200],{"__ignoreMap":313},[318,1201,1202,1205,1208,1211],{"class":320,"line":321},[318,1203,1204],{"class":844},"sudo",[318,1206,1207],{"class":678}," systemctl",[318,1209,1210],{"class":678}," restart",[318,1212,1213],{"class":678}," rsyslog\n",[363,1215,1217],{"id":1216},"rfc-5424-format-with-rsyslog","RFC 5424 Format with rsyslog",[208,1219,1220],{},"By default rsyslog sends RFC 3164. To send RFC 5424 (recommended):",[308,1222,1225],{"className":1223,"code":1224,"language":375},[373],"# Use RFC 5424 format\ntemplate(name=\"RFC5424\" type=\"string\"\n  string=\"\u003C%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %MSG%\\n\")\n\n*.* action(type=\"omfwd\"\n          target=\"127.0.0.1\"\n          port=\"54527\"\n          protocol=\"tcp\"\n          Template=\"RFC5424\"\n          queue.type=\"linkedList\"\n          queue.size=\"10000\")\n",[315,1226,1224],{"__ignoreMap":313},[208,1228,1229,1230,1233],{},"Update your Collector config to use ",[315,1231,1232],{},"protocol: rfc5424"," when using this template.",[363,1235,1237],{"id":1236},"tls-forwarding-with-rsyslog","TLS Forwarding with rsyslog",[308,1239,1242],{"className":1240,"code":1241,"language":375},[373],"# Load TLS module\nmodule(load=\"omfwd\")\n\n*.* action(type=\"omfwd\"\n          target=\"collector.internal\"\n          port=\"6514\"\n          protocol=\"tcp\"\n          StreamDriver=\"gtls\"\n          StreamDriverMode=\"1\"\n          StreamDriverAuthMode=\"x509\u002Fname\"\n          StreamDriverPermittedPeers=\"collector.internal\")\n",[315,1243,1241],{"__ignoreMap":313},[238,1245,1247],{"id":1246},"forwarding-from-syslog-ng","Forwarding from syslog-ng",[208,1249,1250],{},"syslog-ng is common on SUSE, Alpine, and systems where more flexibility is needed.",[363,1252,1098],{"id":1253},"basic-tcp-forwarding-1",[208,1255,1256,1257,832],{},"Add to ",[315,1258,1259],{},"\u002Fetc\u002Fsyslog-ng\u002Fsyslog-ng.conf",[308,1261,1264],{"className":1262,"code":1263,"language":375},[373],"destination d_otel {\n    tcp(\"127.0.0.1\"\n        port(54527)\n        flags(no-multi-line)\n    );\n};\n\nlog {\n    source(s_local);\n    destination(d_otel);\n};\n",[315,1265,1263],{"__ignoreMap":313},[363,1267,1269],{"id":1268},"rfc-5424-format-with-syslog-ng","RFC 5424 Format with syslog-ng",[208,1271,1272,1273,1275],{},"Use syslog-ng's built-in ",[315,1274,793],{}," driver, which outputs RFC 5424 natively:",[308,1277,1280],{"className":1278,"code":1279,"language":375},[373],"destination d_otel_rfc5424 {\n    syslog(\"127.0.0.1\"\n        port(54527)\n        transport(tcp)\n    );\n};\n\nlog {\n    source(s_local);\n    destination(d_otel_rfc5424);\n};\n",[315,1281,1279],{"__ignoreMap":313},[208,1283,1284,1285,1288],{},"The ",[315,1286,1287],{},"syslog()"," driver automatically formats messages as RFC 5424 with PRI, version, structured-data, and ISO 8601 timestamps — no custom template needed.",[208,1290,1291],{},"Restart after changes:",[308,1293,1295],{"className":835,"code":1294,"language":837,"meta":313,"style":313},"sudo systemctl restart syslog-ng\n",[315,1296,1297],{"__ignoreMap":313},[318,1298,1299,1301,1303,1305],{"class":320,"line":321},[318,1300,1204],{"class":844},[318,1302,1207],{"class":678},[318,1304,1210],{"class":678},[318,1306,1307],{"class":678}," syslog-ng\n",[238,1309,1311],{"id":1310},"operators-and-enrichment","Operators and Enrichment",[208,1313,1314,1315,233],{},"After the syslog receiver parses protocol fields, you can use operators to transform and enrich log records — the same operators available in the ",[217,1316,261],{"href":1317},"\u002Fguides\u002Fopentelemetry-filelog-receiver#understanding-operators",[363,1319,1321],{"id":1320},"move-message-to-body","Move Message to Body",[208,1323,1324,1325,1328],{},"By default the syslog receiver stores the message text in ",[315,1326,1327],{},"attributes.message",". Move it to the log record body:",[308,1330,1332],{"className":639,"code":1331,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    tcp:\n      listen_address: '0.0.0.0:54527'\n    protocol: rfc3164\n    location: UTC\n    operators:\n      - type: move\n        from: attributes.message\n        to: body\n",[315,1333,1334,1340,1346,1352,1360,1368,1376,1383,1396,1406],{"__ignoreMap":313},[318,1335,1336,1338],{"class":320,"line":321},[318,1337,649],{"class":648},[318,1339,653],{"class":652},[318,1341,1342,1344],{"class":320,"line":327},[318,1343,658],{"class":648},[318,1345,653],{"class":652},[318,1347,1348,1350],{"class":320,"line":333},[318,1349,665],{"class":648},[318,1351,653],{"class":652},[318,1353,1354,1356,1358],{"class":320,"line":339},[318,1355,672],{"class":648},[318,1357,675],{"class":652},[318,1359,679],{"class":678},[318,1361,1362,1364,1366],{"class":320,"line":345},[318,1363,684],{"class":648},[318,1365,675],{"class":652},[318,1367,689],{"class":678},[318,1369,1370,1372,1374],{"class":320,"line":351},[318,1371,694],{"class":648},[318,1373,675],{"class":652},[318,1375,699],{"class":678},[318,1377,1378,1381],{"class":320,"line":702},[318,1379,1380],{"class":648},"    operators",[318,1382,653],{"class":652},[318,1384,1385,1388,1391,1393],{"class":320,"line":709},[318,1386,1387],{"class":652},"      - ",[318,1389,1390],{"class":648},"type",[318,1392,675],{"class":652},[318,1394,1395],{"class":678},"move\n",[318,1397,1398,1401,1403],{"class":320,"line":717},[318,1399,1400],{"class":648},"        from",[318,1402,675],{"class":652},[318,1404,1405],{"class":678},"attributes.message\n",[318,1407,1408,1411,1413],{"class":320,"line":725},[318,1409,1410],{"class":648},"        to",[318,1412,675],{"class":652},[318,1414,1415],{"class":678},"body\n",[363,1417,1419],{"id":1418},"add-environment-metadata","Add Environment Metadata",[208,1421,1422],{},"Enrich all received logs with service and environment context:",[308,1424,1426],{"className":639,"code":1425,"language":641,"meta":313,"style":313},"operators:\n  - type: move\n    from: attributes.message\n    to: body\n  - type: add\n    field: resource[\"service.name\"]\n    value: infrastructure\n  - type: add\n    field: attributes.environment\n    value: production\n",[315,1427,1428,1435,1446,1455,1464,1475,1485,1495,1505,1514],{"__ignoreMap":313},[318,1429,1430,1433],{"class":320,"line":321},[318,1431,1432],{"class":648},"operators",[318,1434,653],{"class":652},[318,1436,1437,1440,1442,1444],{"class":320,"line":327},[318,1438,1439],{"class":652},"  - ",[318,1441,1390],{"class":648},[318,1443,675],{"class":652},[318,1445,1395],{"class":678},[318,1447,1448,1451,1453],{"class":320,"line":333},[318,1449,1450],{"class":648},"    from",[318,1452,675],{"class":652},[318,1454,1405],{"class":678},[318,1456,1457,1460,1462],{"class":320,"line":339},[318,1458,1459],{"class":648},"    to",[318,1461,675],{"class":652},[318,1463,1415],{"class":678},[318,1465,1466,1468,1470,1472],{"class":320,"line":345},[318,1467,1439],{"class":652},[318,1469,1390],{"class":648},[318,1471,675],{"class":652},[318,1473,1474],{"class":678},"add\n",[318,1476,1477,1480,1482],{"class":320,"line":351},[318,1478,1479],{"class":648},"    field",[318,1481,675],{"class":652},[318,1483,1484],{"class":678},"resource[\"service.name\"]\n",[318,1486,1487,1490,1492],{"class":320,"line":702},[318,1488,1489],{"class":648},"    value",[318,1491,675],{"class":652},[318,1493,1494],{"class":678},"infrastructure\n",[318,1496,1497,1499,1501,1503],{"class":320,"line":709},[318,1498,1439],{"class":652},[318,1500,1390],{"class":648},[318,1502,675],{"class":652},[318,1504,1474],{"class":678},[318,1506,1507,1509,1511],{"class":320,"line":717},[318,1508,1479],{"class":648},[318,1510,675],{"class":652},[318,1512,1513],{"class":678},"attributes.environment\n",[318,1515,1516,1518,1520],{"class":320,"line":725},[318,1517,1489],{"class":648},[318,1519,675],{"class":652},[318,1521,1522],{"class":678},"production\n",[363,1524,1526],{"id":1525},"filter-by-facility","Filter by Facility",[208,1528,1529],{},"Forward only security-related logs (facility 4 = security\u002Fauth):",[308,1531,1533],{"className":639,"code":1532,"language":641,"meta":313,"style":313},"operators:\n  - type: filter\n    expr: 'attributes.facility != 4 and attributes.facility != 10'\n",[315,1534,1535,1541,1552],{"__ignoreMap":313},[318,1536,1537,1539],{"class":320,"line":321},[318,1538,1432],{"class":648},[318,1540,653],{"class":652},[318,1542,1543,1545,1547,1549],{"class":320,"line":327},[318,1544,1439],{"class":652},[318,1546,1390],{"class":648},[318,1548,675],{"class":652},[318,1550,1551],{"class":678},"filter\n",[318,1553,1554,1557,1559],{"class":320,"line":333},[318,1555,1556],{"class":648},"    expr",[318,1558,675],{"class":652},[318,1560,1561],{"class":678},"'attributes.facility != 4 and attributes.facility != 10'\n",[208,1563,1564],{},"Syslog facility numbers:",[382,1566,1567,1577],{},[385,1568,1569],{},[388,1570,1571,1574],{},[391,1572,1573],{},"Number",[391,1575,1576],{},"Facility",[398,1578,1579,1587,1594,1602,1610,1618,1626],{},[388,1580,1581,1584],{},[403,1582,1583],{},"0",[403,1585,1586],{},"kernel",[388,1588,1589,1591],{},[403,1590,520],{},[403,1592,1593],{},"user-level",[388,1595,1596,1599],{},[403,1597,1598],{},"3",[403,1600,1601],{},"system daemons",[388,1603,1604,1607],{},[403,1605,1606],{},"4",[403,1608,1609],{},"security\u002Fauth",[388,1611,1612,1615],{},[403,1613,1614],{},"7",[403,1616,1617],{},"news",[388,1619,1620,1623],{},[403,1621,1622],{},"10",[403,1624,1625],{},"security\u002Fauth (alt)",[388,1627,1628,1631],{},[403,1629,1630],{},"16-23",[403,1632,1633],{},"local0–local7 (custom)",[363,1635,1637],{"id":1636},"parse-structured-data-rfc-5424","Parse Structured Data (RFC 5424)",[208,1639,1640,1641,1644,1645,1648],{},"RFC 5424 ",[315,1642,1643],{},"STRUCTURED-DATA"," fields land in ",[315,1646,1647],{},"attributes.structured_data",". Extract individual values:",[308,1650,1652],{"className":639,"code":1651,"language":641,"meta":313,"style":313},"operators:\n  - type: move\n    from: attributes.message\n    to: body\n  - type: regex_parser\n    parse_from: attributes.structured_data\n    regex: 'requestId=\"(?P\u003Crequest_id>[^\"]+)\"'\n    if: 'attributes.structured_data != \"-\"'\n",[315,1653,1654,1660,1670,1678,1686,1697,1707,1717],{"__ignoreMap":313},[318,1655,1656,1658],{"class":320,"line":321},[318,1657,1432],{"class":648},[318,1659,653],{"class":652},[318,1661,1662,1664,1666,1668],{"class":320,"line":327},[318,1663,1439],{"class":652},[318,1665,1390],{"class":648},[318,1667,675],{"class":652},[318,1669,1395],{"class":678},[318,1671,1672,1674,1676],{"class":320,"line":333},[318,1673,1450],{"class":648},[318,1675,675],{"class":652},[318,1677,1405],{"class":678},[318,1679,1680,1682,1684],{"class":320,"line":339},[318,1681,1459],{"class":648},[318,1683,675],{"class":652},[318,1685,1415],{"class":678},[318,1687,1688,1690,1692,1694],{"class":320,"line":345},[318,1689,1439],{"class":652},[318,1691,1390],{"class":648},[318,1693,675],{"class":652},[318,1695,1696],{"class":678},"regex_parser\n",[318,1698,1699,1702,1704],{"class":320,"line":351},[318,1700,1701],{"class":648},"    parse_from",[318,1703,675],{"class":652},[318,1705,1706],{"class":678},"attributes.structured_data\n",[318,1708,1709,1712,1714],{"class":320,"line":702},[318,1710,1711],{"class":648},"    regex",[318,1713,675],{"class":652},[318,1715,1716],{"class":678},"'requestId=\"(?P\u003Crequest_id>[^\"]+)\"'\n",[318,1718,1719,1722,1724],{"class":320,"line":709},[318,1720,1721],{"class":648},"    if",[318,1723,675],{"class":652},[318,1725,1726],{"class":678},"'attributes.structured_data != \"-\"'\n",[238,1728,1730],{"id":1729},"kubernetes-syslog-collection","Kubernetes Syslog Collection",[208,1732,1733,1734,233],{},"In Kubernetes, syslog receivers are useful for collecting node-level system logs (kernel, kubelet, systemd) rather than container stdout\u002Fstderr — those are better handled by the ",[217,1735,1737],{"href":1736},"\u002Fguides\u002Fopentelemetry-filelog-receiver#kubernetes-log-collection","Filelog Receiver with the container operator",[363,1739,1741],{"id":1740},"daemonset-with-syslog-receiver","DaemonSet with Syslog Receiver",[208,1743,1744],{},"Deploy on every node to collect system-level syslog:",[308,1746,1748],{"className":639,"code":1747,"language":641,"meta":313,"style":313},"apiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: otel-collector-syslog\n  namespace: monitoring\nspec:\n  selector:\n    matchLabels:\n      app: otel-collector-syslog\n  template:\n    metadata:\n      labels:\n        app: otel-collector-syslog\n    spec:\n      hostNetwork: true   # Access host network to receive syslog\n      containers:\n      - name: otel-collector\n        image: otel\u002Fopentelemetry-collector-contrib:latest\n        ports:\n        - containerPort: 54527\n          hostPort: 54527\n          protocol: TCP\n        volumeMounts:\n        - name: config\n          mountPath: \u002Fetc\u002Fotelcol-contrib\u002F\n      volumes:\n      - name: config\n        configMap:\n          name: otel-collector-syslog-config\n",[315,1749,1750,1760,1770,1777,1787,1797,1804,1811,1818,1827,1834,1841,1848,1857,1864,1877,1884,1896,1906,1914,1928,1938,1949,1957,1969,1980,1988,1999,2007],{"__ignoreMap":313},[318,1751,1752,1755,1757],{"class":320,"line":321},[318,1753,1754],{"class":648},"apiVersion",[318,1756,675],{"class":652},[318,1758,1759],{"class":678},"apps\u002Fv1\n",[318,1761,1762,1765,1767],{"class":320,"line":327},[318,1763,1764],{"class":648},"kind",[318,1766,675],{"class":652},[318,1768,1769],{"class":678},"DaemonSet\n",[318,1771,1772,1775],{"class":320,"line":333},[318,1773,1774],{"class":648},"metadata",[318,1776,653],{"class":652},[318,1778,1779,1782,1784],{"class":320,"line":339},[318,1780,1781],{"class":648},"  name",[318,1783,675],{"class":652},[318,1785,1786],{"class":678},"otel-collector-syslog\n",[318,1788,1789,1792,1794],{"class":320,"line":345},[318,1790,1791],{"class":648},"  namespace",[318,1793,675],{"class":652},[318,1795,1796],{"class":678},"monitoring\n",[318,1798,1799,1802],{"class":320,"line":351},[318,1800,1801],{"class":648},"spec",[318,1803,653],{"class":652},[318,1805,1806,1809],{"class":320,"line":702},[318,1807,1808],{"class":648},"  selector",[318,1810,653],{"class":652},[318,1812,1813,1816],{"class":320,"line":709},[318,1814,1815],{"class":648},"    matchLabels",[318,1817,653],{"class":652},[318,1819,1820,1823,1825],{"class":320,"line":717},[318,1821,1822],{"class":648},"      app",[318,1824,675],{"class":652},[318,1826,1786],{"class":678},[318,1828,1829,1832],{"class":320,"line":725},[318,1830,1831],{"class":648},"  template",[318,1833,653],{"class":652},[318,1835,1836,1839],{"class":320,"line":736},[318,1837,1838],{"class":648},"    metadata",[318,1840,653],{"class":652},[318,1842,1843,1846],{"class":320,"line":744},[318,1844,1845],{"class":648},"      labels",[318,1847,653],{"class":652},[318,1849,1850,1853,1855],{"class":320,"line":755},[318,1851,1852],{"class":648},"        app",[318,1854,675],{"class":652},[318,1856,1786],{"class":678},[318,1858,1859,1862],{"class":320,"line":760},[318,1860,1861],{"class":648},"    spec",[318,1863,653],{"class":652},[318,1865,1866,1869,1871,1874],{"class":320,"line":768},[318,1867,1868],{"class":648},"      hostNetwork",[318,1870,675],{"class":652},[318,1872,1873],{"class":847},"true",[318,1875,1876],{"class":918},"   # Access host network to receive syslog\n",[318,1878,1879,1882],{"class":320,"line":776},[318,1880,1881],{"class":648},"      containers",[318,1883,653],{"class":652},[318,1885,1886,1888,1891,1893],{"class":320,"line":784},[318,1887,1387],{"class":652},[318,1889,1890],{"class":648},"name",[318,1892,675],{"class":652},[318,1894,1895],{"class":678},"otel-collector\n",[318,1897,1898,1901,1903],{"class":320,"line":799},[318,1899,1900],{"class":648},"        image",[318,1902,675],{"class":652},[318,1904,1905],{"class":678},"otel\u002Fopentelemetry-collector-contrib:latest\n",[318,1907,1909,1912],{"class":320,"line":1908},19,[318,1910,1911],{"class":648},"        ports",[318,1913,653],{"class":652},[318,1915,1917,1920,1923,1925],{"class":320,"line":1916},20,[318,1918,1919],{"class":652},"        - ",[318,1921,1922],{"class":648},"containerPort",[318,1924,675],{"class":652},[318,1926,1927],{"class":847},"54527\n",[318,1929,1931,1934,1936],{"class":320,"line":1930},21,[318,1932,1933],{"class":648},"          hostPort",[318,1935,675],{"class":652},[318,1937,1927],{"class":847},[318,1939,1941,1944,1946],{"class":320,"line":1940},22,[318,1942,1943],{"class":648},"          protocol",[318,1945,675],{"class":652},[318,1947,1948],{"class":678},"TCP\n",[318,1950,1952,1955],{"class":320,"line":1951},23,[318,1953,1954],{"class":648},"        volumeMounts",[318,1956,653],{"class":652},[318,1958,1960,1962,1964,1966],{"class":320,"line":1959},24,[318,1961,1919],{"class":652},[318,1963,1890],{"class":648},[318,1965,675],{"class":652},[318,1967,1968],{"class":678},"config\n",[318,1970,1972,1975,1977],{"class":320,"line":1971},25,[318,1973,1974],{"class":648},"          mountPath",[318,1976,675],{"class":652},[318,1978,1979],{"class":678},"\u002Fetc\u002Fotelcol-contrib\u002F\n",[318,1981,1983,1986],{"class":320,"line":1982},26,[318,1984,1985],{"class":648},"      volumes",[318,1987,653],{"class":652},[318,1989,1991,1993,1995,1997],{"class":320,"line":1990},27,[318,1992,1387],{"class":652},[318,1994,1890],{"class":648},[318,1996,675],{"class":652},[318,1998,1968],{"class":678},[318,2000,2002,2005],{"class":320,"line":2001},28,[318,2003,2004],{"class":648},"        configMap",[318,2006,653],{"class":652},[318,2008,2010,2013,2015],{"class":320,"line":2009},29,[318,2011,2012],{"class":648},"          name",[318,2014,675],{"class":652},[318,2016,2017],{"class":678},"otel-collector-syslog-config\n",[208,2019,2020],{},"Collector ConfigMap:",[308,2022,2024],{"className":639,"code":2023,"language":641,"meta":313,"style":313},"apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: otel-collector-syslog-config\n  namespace: monitoring\ndata:\n  config.yaml: |\n    receivers:\n      syslog:\n        tcp:\n          listen_address: '0.0.0.0:54527'\n        protocol: rfc5424\n        operators:\n          - type: move\n            from: attributes.message\n            to: body\n          - type: add\n            field: resource[\"k8s.node.name\"]\n            value: ${env:NODE_NAME}\n\n    processors:\n      batch:\n        timeout: 10s\n\n    exporters:\n      otlp\u002Fuptrace:\n        endpoint: api.uptrace.dev:4317\n        headers:\n          uptrace-dsn: 'https:\u002F\u002F\u003Csecret>@api.uptrace.dev?grpc=4317'\n\n    service:\n      pipelines:\n        logs:\n          receivers: [syslog]\n          processors: [batch]\n          exporters: [otlp\u002Fuptrace]\n",[315,2025,2026,2035,2044,2050,2058,2066,2073,2084,2089,2094,2099,2104,2109,2114,2119,2124,2129,2134,2139,2144,2148,2153,2158,2163,2167,2172,2177,2182,2187,2192,2197,2203,2209,2215,2221,2227],{"__ignoreMap":313},[318,2027,2028,2030,2032],{"class":320,"line":321},[318,2029,1754],{"class":648},[318,2031,675],{"class":652},[318,2033,2034],{"class":678},"v1\n",[318,2036,2037,2039,2041],{"class":320,"line":327},[318,2038,1764],{"class":648},[318,2040,675],{"class":652},[318,2042,2043],{"class":678},"ConfigMap\n",[318,2045,2046,2048],{"class":320,"line":333},[318,2047,1774],{"class":648},[318,2049,653],{"class":652},[318,2051,2052,2054,2056],{"class":320,"line":339},[318,2053,1781],{"class":648},[318,2055,675],{"class":652},[318,2057,2017],{"class":678},[318,2059,2060,2062,2064],{"class":320,"line":345},[318,2061,1791],{"class":648},[318,2063,675],{"class":652},[318,2065,1796],{"class":678},[318,2067,2068,2071],{"class":320,"line":351},[318,2069,2070],{"class":648},"data",[318,2072,653],{"class":652},[318,2074,2075,2078,2080],{"class":320,"line":702},[318,2076,2077],{"class":648},"  config.yaml",[318,2079,675],{"class":652},[318,2081,2083],{"class":2082},"sD7c4","|\n",[318,2085,2086],{"class":320,"line":709},[318,2087,2088],{"class":678},"    receivers:\n",[318,2090,2091],{"class":320,"line":717},[318,2092,2093],{"class":678},"      syslog:\n",[318,2095,2096],{"class":320,"line":725},[318,2097,2098],{"class":678},"        tcp:\n",[318,2100,2101],{"class":320,"line":736},[318,2102,2103],{"class":678},"          listen_address: '0.0.0.0:54527'\n",[318,2105,2106],{"class":320,"line":744},[318,2107,2108],{"class":678},"        protocol: rfc5424\n",[318,2110,2111],{"class":320,"line":755},[318,2112,2113],{"class":678},"        operators:\n",[318,2115,2116],{"class":320,"line":760},[318,2117,2118],{"class":678},"          - type: move\n",[318,2120,2121],{"class":320,"line":768},[318,2122,2123],{"class":678},"            from: attributes.message\n",[318,2125,2126],{"class":320,"line":776},[318,2127,2128],{"class":678},"            to: body\n",[318,2130,2131],{"class":320,"line":784},[318,2132,2133],{"class":678},"          - type: add\n",[318,2135,2136],{"class":320,"line":799},[318,2137,2138],{"class":678},"            field: resource[\"k8s.node.name\"]\n",[318,2140,2141],{"class":320,"line":1908},[318,2142,2143],{"class":678},"            value: ${env:NODE_NAME}\n",[318,2145,2146],{"class":320,"line":1916},[318,2147,706],{"emptyLinePlaceholder":705},[318,2149,2150],{"class":320,"line":1930},[318,2151,2152],{"class":678},"    processors:\n",[318,2154,2155],{"class":320,"line":1940},[318,2156,2157],{"class":678},"      batch:\n",[318,2159,2160],{"class":320,"line":1951},[318,2161,2162],{"class":678},"        timeout: 10s\n",[318,2164,2165],{"class":320,"line":1959},[318,2166,706],{"emptyLinePlaceholder":705},[318,2168,2169],{"class":320,"line":1971},[318,2170,2171],{"class":678},"    exporters:\n",[318,2173,2174],{"class":320,"line":1982},[318,2175,2176],{"class":678},"      otlp\u002Fuptrace:\n",[318,2178,2179],{"class":320,"line":1990},[318,2180,2181],{"class":678},"        endpoint: api.uptrace.dev:4317\n",[318,2183,2184],{"class":320,"line":2001},[318,2185,2186],{"class":678},"        headers:\n",[318,2188,2189],{"class":320,"line":2009},[318,2190,2191],{"class":678},"          uptrace-dsn: 'https:\u002F\u002F\u003Csecret>@api.uptrace.dev?grpc=4317'\n",[318,2193,2195],{"class":320,"line":2194},30,[318,2196,706],{"emptyLinePlaceholder":705},[318,2198,2200],{"class":320,"line":2199},31,[318,2201,2202],{"class":678},"    service:\n",[318,2204,2206],{"class":320,"line":2205},32,[318,2207,2208],{"class":678},"      pipelines:\n",[318,2210,2212],{"class":320,"line":2211},33,[318,2213,2214],{"class":678},"        logs:\n",[318,2216,2218],{"class":320,"line":2217},34,[318,2219,2220],{"class":678},"          receivers: [syslog]\n",[318,2222,2224],{"class":320,"line":2223},35,[318,2225,2226],{"class":678},"          processors: [batch]\n",[318,2228,2230],{"class":320,"line":2229},36,[318,2231,2232],{"class":678},"          exporters: [otlp\u002Fuptrace]\n",[208,2234,2235],{},"Configure each node's rsyslog to forward to the DaemonSet pod's hostPort:",[308,2237,2240],{"className":2238,"code":2239,"language":375},[373],"*.* action(type=\"omfwd\"\n          target=\"127.0.0.1\"\n          port=\"54527\"\n          protocol=\"tcp\"\n          queue.type=\"linkedList\"\n          queue.size=\"5000\")\n",[315,2241,2239],{"__ignoreMap":313},[238,2243,2245],{"id":2244},"real-world-examples","Real-World Examples",[363,2247,2249],{"id":2248},"collect-auth-logs-only","Collect Auth Logs Only",[308,2251,2253],{"className":639,"code":2252,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    tcp:\n      listen_address: '0.0.0.0:54527'\n    protocol: rfc3164\n    location: UTC\n    operators:\n      - type: filter\n        expr: 'attributes.facility != 4 and attributes.facility != 10'\n      - type: move\n        from: attributes.message\n        to: body\n",[315,2254,2255,2261,2267,2273,2281,2289,2297,2303,2313,2322,2332,2340],{"__ignoreMap":313},[318,2256,2257,2259],{"class":320,"line":321},[318,2258,649],{"class":648},[318,2260,653],{"class":652},[318,2262,2263,2265],{"class":320,"line":327},[318,2264,658],{"class":648},[318,2266,653],{"class":652},[318,2268,2269,2271],{"class":320,"line":333},[318,2270,665],{"class":648},[318,2272,653],{"class":652},[318,2274,2275,2277,2279],{"class":320,"line":339},[318,2276,672],{"class":648},[318,2278,675],{"class":652},[318,2280,679],{"class":678},[318,2282,2283,2285,2287],{"class":320,"line":345},[318,2284,684],{"class":648},[318,2286,675],{"class":652},[318,2288,689],{"class":678},[318,2290,2291,2293,2295],{"class":320,"line":351},[318,2292,694],{"class":648},[318,2294,675],{"class":652},[318,2296,699],{"class":678},[318,2298,2299,2301],{"class":320,"line":702},[318,2300,1380],{"class":648},[318,2302,653],{"class":652},[318,2304,2305,2307,2309,2311],{"class":320,"line":709},[318,2306,1387],{"class":652},[318,2308,1390],{"class":648},[318,2310,675],{"class":652},[318,2312,1551],{"class":678},[318,2314,2315,2318,2320],{"class":320,"line":717},[318,2316,2317],{"class":648},"        expr",[318,2319,675],{"class":652},[318,2321,1561],{"class":678},[318,2323,2324,2326,2328,2330],{"class":320,"line":725},[318,2325,1387],{"class":652},[318,2327,1390],{"class":648},[318,2329,675],{"class":652},[318,2331,1395],{"class":678},[318,2333,2334,2336,2338],{"class":320,"line":736},[318,2335,1400],{"class":648},[318,2337,675],{"class":652},[318,2339,1405],{"class":678},[318,2341,2342,2344,2346],{"class":320,"line":744},[318,2343,1410],{"class":648},[318,2345,675],{"class":652},[318,2347,1415],{"class":678},[363,2349,2351],{"id":2350},"network-device-logs-cisco-juniper","Network Device Logs (Cisco \u002F Juniper)",[208,2353,2354],{},"Network equipment typically sends RFC 3164 over UDP from port 514:",[308,2356,2358],{"className":639,"code":2357,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    udp:\n      listen_address: '0.0.0.0:514'\n    protocol: rfc3164\n    location: UTC\n    operators:\n      - type: move\n        from: attributes.message\n        to: body\n      - type: add\n        field: attributes.source_type\n        value: network_device\n",[315,2359,2360,2366,2372,2378,2386,2394,2402,2408,2418,2426,2434,2444,2454],{"__ignoreMap":313},[318,2361,2362,2364],{"class":320,"line":321},[318,2363,649],{"class":648},[318,2365,653],{"class":652},[318,2367,2368,2370],{"class":320,"line":327},[318,2369,658],{"class":648},[318,2371,653],{"class":652},[318,2373,2374,2376],{"class":320,"line":333},[318,2375,957],{"class":648},[318,2377,653],{"class":652},[318,2379,2380,2382,2384],{"class":320,"line":339},[318,2381,672],{"class":648},[318,2383,675],{"class":652},[318,2385,968],{"class":678},[318,2387,2388,2390,2392],{"class":320,"line":345},[318,2389,684],{"class":648},[318,2391,675],{"class":652},[318,2393,689],{"class":678},[318,2395,2396,2398,2400],{"class":320,"line":351},[318,2397,694],{"class":648},[318,2399,675],{"class":652},[318,2401,699],{"class":678},[318,2403,2404,2406],{"class":320,"line":702},[318,2405,1380],{"class":648},[318,2407,653],{"class":652},[318,2409,2410,2412,2414,2416],{"class":320,"line":709},[318,2411,1387],{"class":652},[318,2413,1390],{"class":648},[318,2415,675],{"class":652},[318,2417,1395],{"class":678},[318,2419,2420,2422,2424],{"class":320,"line":717},[318,2421,1400],{"class":648},[318,2423,675],{"class":652},[318,2425,1405],{"class":678},[318,2427,2428,2430,2432],{"class":320,"line":725},[318,2429,1410],{"class":648},[318,2431,675],{"class":652},[318,2433,1415],{"class":678},[318,2435,2436,2438,2440,2442],{"class":320,"line":736},[318,2437,1387],{"class":652},[318,2439,1390],{"class":648},[318,2441,675],{"class":652},[318,2443,1474],{"class":678},[318,2445,2446,2449,2451],{"class":320,"line":744},[318,2447,2448],{"class":648},"        field",[318,2450,675],{"class":652},[318,2452,2453],{"class":678},"attributes.source_type\n",[318,2455,2456,2459,2461],{"class":320,"line":755},[318,2457,2458],{"class":648},"        value",[318,2460,675],{"class":652},[318,2462,2463],{"class":678},"network_device\n",[208,2465,2466],{},"Then in rsyslog, configure specific hosts to forward:",[308,2468,2471],{"className":2469,"code":2470,"language":375},[373],"if $fromhost-ip startswith '10.0.1.' then {\n    action(type=\"omfwd\" target=\"otel-collector\" port=\"514\" protocol=\"udp\")\n    stop\n}\n",[315,2472,2470],{"__ignoreMap":313},[363,2474,2476],{"id":2475},"high-volume-with-filtering-and-batching","High-Volume with Filtering and Batching",[208,2478,2479],{},"Production setup with memory protection and selective forwarding:",[308,2481,2483],{"className":639,"code":2482,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    tcp:\n      listen_address: '0.0.0.0:54527'\n    protocol: rfc5424\n    operators:\n      - type: filter\n        # Drop noisy health-check messages\n        expr: 'body matches \"(?i)health.?check|ping|heartbeat\"'\n      - type: move\n        from: attributes.message\n        to: body\n\nprocessors:\n  memory_limiter:\n    check_interval: 1s\n    limit_mib: 256\n    spike_limit_mib: 64\n  batch:\n    timeout: 5s\n    send_batch_size: 512\n\nexporters:\n  otlp\u002Fuptrace:\n    endpoint: api.uptrace.dev:4317\n    headers:\n      uptrace-dsn: 'https:\u002F\u002F\u003Csecret>@api.uptrace.dev?grpc=4317'\n\nservice:\n  pipelines:\n    logs:\n      receivers: [syslog]\n      processors: [memory_limiter, batch]\n      exporters: [otlp\u002Fuptrace]\n",[315,2484,2485,2491,2497,2503,2511,2519,2525,2535,2540,2549,2559,2567,2575,2579,2586,2593,2603,2613,2623,2630,2640,2650,2654,2660,2666,2674,2680,2688,2692,2698,2704,2710,2720,2738],{"__ignoreMap":313},[318,2486,2487,2489],{"class":320,"line":321},[318,2488,649],{"class":648},[318,2490,653],{"class":652},[318,2492,2493,2495],{"class":320,"line":327},[318,2494,658],{"class":648},[318,2496,653],{"class":652},[318,2498,2499,2501],{"class":320,"line":333},[318,2500,665],{"class":648},[318,2502,653],{"class":652},[318,2504,2505,2507,2509],{"class":320,"line":339},[318,2506,672],{"class":648},[318,2508,675],{"class":652},[318,2510,679],{"class":678},[318,2512,2513,2515,2517],{"class":320,"line":345},[318,2514,684],{"class":648},[318,2516,675],{"class":652},[318,2518,928],{"class":678},[318,2520,2521,2523],{"class":320,"line":351},[318,2522,1380],{"class":648},[318,2524,653],{"class":652},[318,2526,2527,2529,2531,2533],{"class":320,"line":702},[318,2528,1387],{"class":652},[318,2530,1390],{"class":648},[318,2532,675],{"class":652},[318,2534,1551],{"class":678},[318,2536,2537],{"class":320,"line":709},[318,2538,2539],{"class":918},"        # Drop noisy health-check messages\n",[318,2541,2542,2544,2546],{"class":320,"line":717},[318,2543,2317],{"class":648},[318,2545,675],{"class":652},[318,2547,2548],{"class":678},"'body matches \"(?i)health.?check|ping|heartbeat\"'\n",[318,2550,2551,2553,2555,2557],{"class":320,"line":725},[318,2552,1387],{"class":652},[318,2554,1390],{"class":648},[318,2556,675],{"class":652},[318,2558,1395],{"class":678},[318,2560,2561,2563,2565],{"class":320,"line":736},[318,2562,1400],{"class":648},[318,2564,675],{"class":652},[318,2566,1405],{"class":678},[318,2568,2569,2571,2573],{"class":320,"line":744},[318,2570,1410],{"class":648},[318,2572,675],{"class":652},[318,2574,1415],{"class":678},[318,2576,2577],{"class":320,"line":755},[318,2578,706],{"emptyLinePlaceholder":705},[318,2580,2581,2584],{"class":320,"line":760},[318,2582,2583],{"class":648},"processors",[318,2585,653],{"class":652},[318,2587,2588,2591],{"class":320,"line":768},[318,2589,2590],{"class":648},"  memory_limiter",[318,2592,653],{"class":652},[318,2594,2595,2598,2600],{"class":320,"line":776},[318,2596,2597],{"class":648},"    check_interval",[318,2599,675],{"class":652},[318,2601,2602],{"class":678},"1s\n",[318,2604,2605,2608,2610],{"class":320,"line":784},[318,2606,2607],{"class":648},"    limit_mib",[318,2609,675],{"class":652},[318,2611,2612],{"class":847},"256\n",[318,2614,2615,2618,2620],{"class":320,"line":799},[318,2616,2617],{"class":648},"    spike_limit_mib",[318,2619,675],{"class":652},[318,2621,2622],{"class":847},"64\n",[318,2624,2625,2628],{"class":320,"line":1908},[318,2626,2627],{"class":648},"  batch",[318,2629,653],{"class":652},[318,2631,2632,2635,2637],{"class":320,"line":1916},[318,2633,2634],{"class":648},"    timeout",[318,2636,675],{"class":652},[318,2638,2639],{"class":678},"5s\n",[318,2641,2642,2645,2647],{"class":320,"line":1930},[318,2643,2644],{"class":648},"    send_batch_size",[318,2646,675],{"class":652},[318,2648,2649],{"class":847},"512\n",[318,2651,2652],{"class":320,"line":1940},[318,2653,706],{"emptyLinePlaceholder":705},[318,2655,2656,2658],{"class":320,"line":1951},[318,2657,712],{"class":648},[318,2659,653],{"class":652},[318,2661,2662,2664],{"class":320,"line":1959},[318,2663,720],{"class":648},[318,2665,653],{"class":652},[318,2667,2668,2670,2672],{"class":320,"line":1971},[318,2669,728],{"class":648},[318,2671,675],{"class":652},[318,2673,733],{"class":678},[318,2675,2676,2678],{"class":320,"line":1982},[318,2677,739],{"class":648},[318,2679,653],{"class":652},[318,2681,2682,2684,2686],{"class":320,"line":1990},[318,2683,747],{"class":648},[318,2685,675],{"class":652},[318,2687,752],{"class":678},[318,2689,2690],{"class":320,"line":2001},[318,2691,706],{"emptyLinePlaceholder":705},[318,2693,2694,2696],{"class":320,"line":2009},[318,2695,763],{"class":648},[318,2697,653],{"class":652},[318,2699,2700,2702],{"class":320,"line":2194},[318,2701,771],{"class":648},[318,2703,653],{"class":652},[318,2705,2706,2708],{"class":320,"line":2199},[318,2707,779],{"class":648},[318,2709,653],{"class":652},[318,2711,2712,2714,2716,2718],{"class":320,"line":2205},[318,2713,787],{"class":648},[318,2715,790],{"class":652},[318,2717,793],{"class":678},[318,2719,796],{"class":652},[318,2721,2722,2725,2727,2730,2733,2736],{"class":320,"line":2211},[318,2723,2724],{"class":648},"      processors",[318,2726,790],{"class":652},[318,2728,2729],{"class":678},"memory_limiter",[318,2731,2732],{"class":652},", ",[318,2734,2735],{"class":678},"batch",[318,2737,796],{"class":652},[318,2739,2740,2742,2744,2746],{"class":320,"line":2217},[318,2741,802],{"class":648},[318,2743,790],{"class":652},[318,2745,807],{"class":678},[318,2747,796],{"class":652},[205,2749,2750],{},[208,2751,989,2752,2755,2756,2758],{},[212,2753,2754],{},"Order matters:"," ",[315,2757,2729],{}," must be the first processor in the pipeline.",[238,2760,2762],{"id":2761},"troubleshooting","Troubleshooting",[363,2764,2766],{"id":2765},"no-logs-appearing","No Logs Appearing",[208,2768,2769],{},[212,2770,2771],{},"Check 1: Port is open and listening",[308,2773,2775],{"className":835,"code":2774,"language":837,"meta":313,"style":313},"# Verify the port is bound\nss -tlnp | grep 54527\n# or\nnetstat -tlnp | grep 54527\n",[315,2776,2777,2782,2799,2804],{"__ignoreMap":313},[318,2778,2779],{"class":320,"line":321},[318,2780,2781],{"class":918},"# Verify the port is bound\n",[318,2783,2784,2787,2790,2793,2796],{"class":320,"line":327},[318,2785,2786],{"class":844},"ss",[318,2788,2789],{"class":847}," -tlnp",[318,2791,2792],{"class":2082}," |",[318,2794,2795],{"class":844}," grep",[318,2797,2798],{"class":847}," 54527\n",[318,2800,2801],{"class":320,"line":333},[318,2802,2803],{"class":918},"# or\n",[318,2805,2806,2809,2811,2813,2815],{"class":320,"line":339},[318,2807,2808],{"class":844},"netstat",[318,2810,2789],{"class":847},[318,2812,2792],{"class":2082},[318,2814,2795],{"class":844},[318,2816,2798],{"class":847},[208,2818,2819],{},[212,2820,2821],{},"Check 2: Firewall",[308,2823,2825],{"className":835,"code":2824,"language":837,"meta":313,"style":313},"# Allow port (firewalld)\nfirewall-cmd --permanent --add-port=54527\u002Ftcp\nfirewall-cmd --reload\n\n# Or iptables\niptables -A INPUT -p tcp --dport 54527 -j ACCEPT\n",[315,2826,2827,2832,2843,2850,2854,2859],{"__ignoreMap":313},[318,2828,2829],{"class":320,"line":321},[318,2830,2831],{"class":918},"# Allow port (firewalld)\n",[318,2833,2834,2837,2840],{"class":320,"line":327},[318,2835,2836],{"class":844},"firewall-cmd",[318,2838,2839],{"class":847}," --permanent",[318,2841,2842],{"class":847}," --add-port=54527\u002Ftcp\n",[318,2844,2845,2847],{"class":320,"line":333},[318,2846,2836],{"class":844},[318,2848,2849],{"class":847}," --reload\n",[318,2851,2852],{"class":320,"line":339},[318,2853,706],{"emptyLinePlaceholder":705},[318,2855,2856],{"class":320,"line":345},[318,2857,2858],{"class":918},"# Or iptables\n",[318,2860,2861,2864,2867,2870,2873,2876,2879,2881,2884],{"class":320,"line":351},[318,2862,2863],{"class":844},"iptables",[318,2865,2866],{"class":847}," -A",[318,2868,2869],{"class":678}," INPUT",[318,2871,2872],{"class":847}," -p",[318,2874,2875],{"class":678}," tcp",[318,2877,2878],{"class":847}," --dport",[318,2880,857],{"class":847},[318,2882,2883],{"class":847}," -j",[318,2885,2886],{"class":678}," ACCEPT\n",[208,2888,2889],{},[212,2890,2891],{},"Check 3: Test connectivity manually",[308,2893,2895],{"className":835,"code":2894,"language":837,"meta":313,"style":313},"# Send a test message\nlogger -n 127.0.0.1 -P 54527 --tcp \"Test OTel syslog message\"\n\n# For UDP\nlogger -n 127.0.0.1 -P 514 \"Test UDP message\"\n",[315,2896,2897,2902,2919,2923,2928],{"__ignoreMap":313},[318,2898,2899],{"class":320,"line":321},[318,2900,2901],{"class":918},"# Send a test message\n",[318,2903,2904,2906,2908,2910,2912,2914,2916],{"class":320,"line":327},[318,2905,831],{"class":844},[318,2907,848],{"class":847},[318,2909,851],{"class":847},[318,2911,854],{"class":847},[318,2913,857],{"class":847},[318,2915,860],{"class":847},[318,2917,2918],{"class":678}," \"Test OTel syslog message\"\n",[318,2920,2921],{"class":320,"line":333},[318,2922,706],{"emptyLinePlaceholder":705},[318,2924,2925],{"class":320,"line":339},[318,2926,2927],{"class":918},"# For UDP\n",[318,2929,2930,2932,2934,2936,2938,2941],{"class":320,"line":345},[318,2931,831],{"class":844},[318,2933,848],{"class":847},[318,2935,851],{"class":847},[318,2937,854],{"class":847},[318,2939,2940],{"class":847}," 514",[318,2942,2943],{"class":678}," \"Test UDP message\"\n",[208,2945,2946],{},[212,2947,2948],{},"Check 4: Debug exporter",[308,2950,2952],{"className":639,"code":2951,"language":641,"meta":313,"style":313},"exporters:\n  debug:\n    verbosity: detailed\n\nservice:\n  pipelines:\n    logs:\n      receivers: [syslog]\n      exporters: [debug]\n",[315,2953,2954,2960,2967,2977,2981,2987,2993,2999,3009],{"__ignoreMap":313},[318,2955,2956,2958],{"class":320,"line":321},[318,2957,712],{"class":648},[318,2959,653],{"class":652},[318,2961,2962,2965],{"class":320,"line":327},[318,2963,2964],{"class":648},"  debug",[318,2966,653],{"class":652},[318,2968,2969,2972,2974],{"class":320,"line":333},[318,2970,2971],{"class":648},"    verbosity",[318,2973,675],{"class":652},[318,2975,2976],{"class":678},"detailed\n",[318,2978,2979],{"class":320,"line":339},[318,2980,706],{"emptyLinePlaceholder":705},[318,2982,2983,2985],{"class":320,"line":345},[318,2984,763],{"class":648},[318,2986,653],{"class":652},[318,2988,2989,2991],{"class":320,"line":351},[318,2990,771],{"class":648},[318,2992,653],{"class":652},[318,2994,2995,2997],{"class":320,"line":702},[318,2996,779],{"class":648},[318,2998,653],{"class":652},[318,3000,3001,3003,3005,3007],{"class":320,"line":709},[318,3002,787],{"class":648},[318,3004,790],{"class":652},[318,3006,793],{"class":678},[318,3008,796],{"class":652},[318,3010,3011,3013,3015,3018],{"class":320,"line":717},[318,3012,802],{"class":648},[318,3014,790],{"class":652},[318,3016,3017],{"class":678},"debug",[318,3019,796],{"class":652},[308,3021,3023],{"className":835,"code":3022,"language":837,"meta":313,"style":313},".\u002Fotelcol --config=config.yaml 2>&1 | grep -i \"log\\|syslog\\|error\"\n",[315,3024,3025],{"__ignoreMap":313},[318,3026,3027,3030,3033,3036,3038,3040,3043],{"class":320,"line":321},[318,3028,3029],{"class":844},".\u002Fotelcol",[318,3031,3032],{"class":847}," --config=config.yaml",[318,3034,3035],{"class":2082}," 2>&1",[318,3037,2792],{"class":2082},[318,3039,2795],{"class":844},[318,3041,3042],{"class":847}," -i",[318,3044,3045],{"class":678}," \"log\\|syslog\\|error\"\n",[363,3047,3049],{"id":3048},"parse-errors","Parse Errors",[208,3051,3052,2755,3055,3058],{},[212,3053,3054],{},"Problem:",[315,3056,3057],{},"failed to parse syslog message"," in Collector logs.",[208,3060,3061,3064],{},[212,3062,3063],{},"Cause:"," Protocol mismatch — your sender uses RFC 3164 but Collector expects RFC 5424, or vice versa.",[208,3066,3067],{},[212,3068,3069],{},"Diagnose:",[308,3071,3073],{"className":835,"code":3072,"language":837,"meta":313,"style":313},"# Capture raw syslog messages to inspect format\nnc -l 54528 | head -5\n# Then point rsyslog temporarily at port 54528\n",[315,3074,3075,3080,3099],{"__ignoreMap":313},[318,3076,3077],{"class":320,"line":321},[318,3078,3079],{"class":918},"# Capture raw syslog messages to inspect format\n",[318,3081,3082,3085,3088,3091,3093,3096],{"class":320,"line":327},[318,3083,3084],{"class":844},"nc",[318,3086,3087],{"class":847}," -l",[318,3089,3090],{"class":847}," 54528",[318,3092,2792],{"class":2082},[318,3094,3095],{"class":844}," head",[318,3097,3098],{"class":847}," -5\n",[318,3100,3101],{"class":320,"line":333},[318,3102,3103],{"class":918},"# Then point rsyslog temporarily at port 54528\n",[208,3105,3106,3109,3110,3112],{},[212,3107,3108],{},"Fix:"," Match ",[315,3111,1153],{}," in Collector config to what your sender actually produces.",[363,3114,3116],{"id":3115},"rsyslog-not-forwarding","rsyslog Not Forwarding",[208,3118,3119],{},[212,3120,3121],{},"Verify rsyslog is sending:",[308,3123,3125],{"className":835,"code":3124,"language":837,"meta":313,"style":313},"# Check rsyslog for errors\njournalctl -u rsyslog -f\n\n# Test rsyslog config\nrsyslogd -N1\n",[315,3126,3127,3132,3146,3150,3155],{"__ignoreMap":313},[318,3128,3129],{"class":320,"line":321},[318,3130,3131],{"class":918},"# Check rsyslog for errors\n",[318,3133,3134,3137,3140,3143],{"class":320,"line":327},[318,3135,3136],{"class":844},"journalctl",[318,3138,3139],{"class":847}," -u",[318,3141,3142],{"class":678}," rsyslog",[318,3144,3145],{"class":847}," -f\n",[318,3147,3148],{"class":320,"line":333},[318,3149,706],{"emptyLinePlaceholder":705},[318,3151,3152],{"class":320,"line":339},[318,3153,3154],{"class":918},"# Test rsyslog config\n",[318,3156,3157,3160],{"class":320,"line":345},[318,3158,3159],{"class":844},"rsyslogd",[318,3161,3162],{"class":847}," -N1\n",[208,3164,3165],{},[212,3166,3167],{},"Check the queue isn't blocked:",[308,3169,3171],{"className":835,"code":3170,"language":837,"meta":313,"style":313},"# Look for \"action suspended\" messages\ngrep \"action suspended\" \u002Fvar\u002Flog\u002Fsyslog\n",[315,3172,3173,3178],{"__ignoreMap":313},[318,3174,3175],{"class":320,"line":321},[318,3176,3177],{"class":918},"# Look for \"action suspended\" messages\n",[318,3179,3180,3183,3186],{"class":320,"line":327},[318,3181,3182],{"class":844},"grep",[318,3184,3185],{"class":678}," \"action suspended\"",[318,3187,3188],{"class":678}," \u002Fvar\u002Flog\u002Fsyslog\n",[208,3190,3191],{},"If Collector was down and the queue filled up, restart rsyslog after bringing Collector back up:",[308,3193,3194],{"className":835,"code":1197,"language":837,"meta":313,"style":313},[315,3195,3196],{"__ignoreMap":313},[318,3197,3198,3200,3202,3204],{"class":320,"line":321},[318,3199,1204],{"class":844},[318,3201,1207],{"class":678},[318,3203,1210],{"class":678},[318,3205,1213],{"class":678},[363,3207,3209],{"id":3208},"high-memory-usage","High Memory Usage",[208,3211,3212],{},[212,3213,3214],{},"Reduce batch size and add memory limiter:",[308,3216,3218],{"className":639,"code":3217,"language":641,"meta":313,"style":313},"processors:\n  memory_limiter:\n    check_interval: 1s\n    limit_mib: 128\n  batch:\n    timeout: 5s\n    send_batch_size: 256\n",[315,3219,3220,3226,3232,3240,3249,3255,3263],{"__ignoreMap":313},[318,3221,3222,3224],{"class":320,"line":321},[318,3223,2583],{"class":648},[318,3225,653],{"class":652},[318,3227,3228,3230],{"class":320,"line":327},[318,3229,2590],{"class":648},[318,3231,653],{"class":652},[318,3233,3234,3236,3238],{"class":320,"line":333},[318,3235,2597],{"class":648},[318,3237,675],{"class":652},[318,3239,2602],{"class":678},[318,3241,3242,3244,3246],{"class":320,"line":339},[318,3243,2607],{"class":648},[318,3245,675],{"class":652},[318,3247,3248],{"class":847},"128\n",[318,3250,3251,3253],{"class":320,"line":345},[318,3252,2627],{"class":648},[318,3254,653],{"class":652},[318,3256,3257,3259,3261],{"class":320,"line":351},[318,3258,2634],{"class":648},[318,3260,675],{"class":652},[318,3262,2639],{"class":678},[318,3264,3265,3267,3269],{"class":320,"line":702},[318,3266,2644],{"class":648},[318,3268,675],{"class":652},[318,3270,2612],{"class":847},[208,3272,3273],{},[212,3274,3275],{},"Filter noisy senders in rsyslog before they reach the Collector:",[308,3277,3280],{"className":3278,"code":3279,"language":375},[373],"# Drop debug messages before forwarding\nif $syslogseverity >= 7 then stop\n\n*.* action(type=\"omfwd\" target=\"127.0.0.1\" port=\"54527\" protocol=\"tcp\")\n",[315,3281,3279],{"__ignoreMap":313},[238,3283,3285],{"id":3284},"performance-optimization","Performance Optimization",[363,3287,3289],{"id":3288},"batching","Batching",[208,3291,3292],{},"Reduces network round-trips to the backend:",[308,3294,3296],{"className":639,"code":3295,"language":641,"meta":313,"style":313},"processors:\n  batch:\n    timeout: 5s           # Send at least every 5s\n    send_batch_size: 512  # Or when 512 records accumulate\n\nservice:\n  pipelines:\n    logs:\n      receivers: [syslog]\n      processors: [batch]\n      exporters: [otlp\u002Fuptrace]\n",[315,3297,3298,3304,3310,3322,3334,3338,3344,3350,3356,3366,3376],{"__ignoreMap":313},[318,3299,3300,3302],{"class":320,"line":321},[318,3301,2583],{"class":648},[318,3303,653],{"class":652},[318,3305,3306,3308],{"class":320,"line":327},[318,3307,2627],{"class":648},[318,3309,653],{"class":652},[318,3311,3312,3314,3316,3319],{"class":320,"line":333},[318,3313,2634],{"class":648},[318,3315,675],{"class":652},[318,3317,3318],{"class":678},"5s",[318,3320,3321],{"class":918},"           # Send at least every 5s\n",[318,3323,3324,3326,3328,3331],{"class":320,"line":339},[318,3325,2644],{"class":648},[318,3327,675],{"class":652},[318,3329,3330],{"class":847},"512",[318,3332,3333],{"class":918},"  # Or when 512 records accumulate\n",[318,3335,3336],{"class":320,"line":345},[318,3337,706],{"emptyLinePlaceholder":705},[318,3339,3340,3342],{"class":320,"line":351},[318,3341,763],{"class":648},[318,3343,653],{"class":652},[318,3345,3346,3348],{"class":320,"line":702},[318,3347,771],{"class":648},[318,3349,653],{"class":652},[318,3351,3352,3354],{"class":320,"line":709},[318,3353,779],{"class":648},[318,3355,653],{"class":652},[318,3357,3358,3360,3362,3364],{"class":320,"line":717},[318,3359,787],{"class":648},[318,3361,790],{"class":652},[318,3363,793],{"class":678},[318,3365,796],{"class":652},[318,3367,3368,3370,3372,3374],{"class":320,"line":725},[318,3369,2724],{"class":648},[318,3371,790],{"class":652},[318,3373,2735],{"class":678},[318,3375,796],{"class":652},[318,3377,3378,3380,3382,3384],{"class":320,"line":736},[318,3379,802],{"class":648},[318,3381,790],{"class":652},[318,3383,807],{"class":678},[318,3385,796],{"class":652},[208,3387,3388],{},[212,3389,3390],{},"Guidelines:",[268,3392,3393,3399,3406],{},[271,3394,3395,3396],{},"Low latency requirements: ",[315,3397,3398],{},"timeout: 1-2s",[271,3400,3401,3402,3405],{},"High volume: increase ",[315,3403,3404],{},"send_batch_size"," to 1024–2048",[271,3407,3408],{},"Default (200 records \u002F 200ms) is fine for moderate load",[363,3410,3412],{"id":3411},"tcp-vs-udp-performance","TCP vs UDP Performance",[268,3414,3415,3420],{},[271,3416,3417,3419],{},[212,3418,932],{},": lower overhead, no connection state, suitable for > 50k msg\u002Fsec",[271,3421,3422,3425],{},[212,3423,3424],{},"TCP",": connection overhead but retries on failure — better for reliability",[208,3427,3428],{},"For very high volume with TCP, increase the OS socket buffer:",[308,3430,3432],{"className":835,"code":3431,"language":837,"meta":313,"style":313},"sysctl -w net.core.rmem_max=8388608\nsysctl -w net.core.rmem_default=8388608\n",[315,3433,3434,3448],{"__ignoreMap":313},[318,3435,3436,3439,3442,3445],{"class":320,"line":321},[318,3437,3438],{"class":844},"sysctl",[318,3440,3441],{"class":847}," -w",[318,3443,3444],{"class":678}," net.core.rmem_max=",[318,3446,3447],{"class":847},"8388608\n",[318,3449,3450,3452,3454,3457],{"class":320,"line":327},[318,3451,3438],{"class":844},[318,3453,3441],{"class":847},[318,3455,3456],{"class":678}," net.core.rmem_default=",[318,3458,3447],{"class":847},[238,3460,3462],{"id":3461},"faq","FAQ",[3464,3465,3466,3486,3495,3628,3690,3711,3719],"ol",{},[271,3467,3468,3471],{},[212,3469,3470],{},"What's the difference between Syslog Receiver and Filelog Receiver?",[268,3472,3473,3479],{},[271,3474,3475,3478],{},[212,3476,3477],{},"Syslog Receiver",": push-based, receives messages over the network (TCP\u002FUDP). Best for remote systems, network devices, and existing rsyslog\u002Fsyslog-ng infrastructure.",[271,3480,3481,3485],{},[212,3482,3483],{},[217,3484,261],{"href":50},": pull-based, reads log files from disk. Best for local application logs, container logs, and any file-based log source.",[271,3487,3488,3491,3494],{},[212,3489,3490],{},"Which protocol should I use — RFC 3164 or RFC 5424?",[3492,3493],"br",{},"\nUse RFC 5424 for new deployments — it includes timezone in timestamps, structured data fields, and a message ID. Use RFC 3164 only when your sender doesn't support RFC 5424 (older network devices, legacy apps).",[271,3496,3497,3500,3502,3503],{},[212,3498,3499],{},"Can I receive from multiple sources simultaneously?",[3492,3501],{},"\nYes. Define multiple named receivers:",[308,3504,3506],{"className":639,"code":3505,"language":641,"meta":313,"style":313},"receivers:\n  syslog\u002Fservers:\n    tcp:\n      listen_address: '0.0.0.0:54527'\n    protocol: rfc5424\n  syslog\u002Fnetwork:\n    udp:\n      listen_address: '0.0.0.0:514'\n    protocol: rfc3164\n    location: UTC\n\nservice:\n  pipelines:\n    logs:\n      receivers: [syslog\u002Fservers, syslog\u002Fnetwork]\n      exporters: [otlp\u002Fuptrace]\n",[315,3507,3508,3514,3521,3527,3535,3543,3550,3556,3564,3572,3580,3584,3590,3596,3602,3618],{"__ignoreMap":313},[318,3509,3510,3512],{"class":320,"line":321},[318,3511,649],{"class":648},[318,3513,653],{"class":652},[318,3515,3516,3519],{"class":320,"line":327},[318,3517,3518],{"class":648},"  syslog\u002Fservers",[318,3520,653],{"class":652},[318,3522,3523,3525],{"class":320,"line":333},[318,3524,665],{"class":648},[318,3526,653],{"class":652},[318,3528,3529,3531,3533],{"class":320,"line":339},[318,3530,672],{"class":648},[318,3532,675],{"class":652},[318,3534,679],{"class":678},[318,3536,3537,3539,3541],{"class":320,"line":345},[318,3538,684],{"class":648},[318,3540,675],{"class":652},[318,3542,928],{"class":678},[318,3544,3545,3548],{"class":320,"line":351},[318,3546,3547],{"class":648},"  syslog\u002Fnetwork",[318,3549,653],{"class":652},[318,3551,3552,3554],{"class":320,"line":702},[318,3553,957],{"class":648},[318,3555,653],{"class":652},[318,3557,3558,3560,3562],{"class":320,"line":709},[318,3559,672],{"class":648},[318,3561,675],{"class":652},[318,3563,968],{"class":678},[318,3565,3566,3568,3570],{"class":320,"line":717},[318,3567,684],{"class":648},[318,3569,675],{"class":652},[318,3571,689],{"class":678},[318,3573,3574,3576,3578],{"class":320,"line":725},[318,3575,694],{"class":648},[318,3577,675],{"class":652},[318,3579,699],{"class":678},[318,3581,3582],{"class":320,"line":736},[318,3583,706],{"emptyLinePlaceholder":705},[318,3585,3586,3588],{"class":320,"line":744},[318,3587,763],{"class":648},[318,3589,653],{"class":652},[318,3591,3592,3594],{"class":320,"line":755},[318,3593,771],{"class":648},[318,3595,653],{"class":652},[318,3597,3598,3600],{"class":320,"line":760},[318,3599,779],{"class":648},[318,3601,653],{"class":652},[318,3603,3604,3606,3608,3611,3613,3616],{"class":320,"line":768},[318,3605,787],{"class":648},[318,3607,790],{"class":652},[318,3609,3610],{"class":678},"syslog\u002Fservers",[318,3612,2732],{"class":652},[318,3614,3615],{"class":678},"syslog\u002Fnetwork",[318,3617,796],{"class":652},[318,3619,3620,3622,3624,3626],{"class":320,"line":776},[318,3621,802],{"class":648},[318,3623,790],{"class":652},[318,3625,807],{"class":678},[318,3627,796],{"class":652},[271,3629,3630,3633,3635,3636,3638,3639],{},[212,3631,3632],{},"Why is the timestamp wrong?",[3492,3634],{},"\nRFC 3164 has no timezone. Set ",[315,3637,470],{}," to match your sender's timezone:",[308,3640,3642],{"className":639,"code":3641,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    udp:\n      listen_address: '0.0.0.0:514'\n    protocol: rfc3164\n    location: America\u002FNew_York  # IANA timezone name\n",[315,3643,3644,3650,3656,3662,3670,3678],{"__ignoreMap":313},[318,3645,3646,3648],{"class":320,"line":321},[318,3647,649],{"class":648},[318,3649,653],{"class":652},[318,3651,3652,3654],{"class":320,"line":327},[318,3653,658],{"class":648},[318,3655,653],{"class":652},[318,3657,3658,3660],{"class":320,"line":333},[318,3659,957],{"class":648},[318,3661,653],{"class":652},[318,3663,3664,3666,3668],{"class":320,"line":339},[318,3665,672],{"class":648},[318,3667,675],{"class":652},[318,3669,968],{"class":678},[318,3671,3672,3674,3676],{"class":320,"line":345},[318,3673,684],{"class":648},[318,3675,675],{"class":652},[318,3677,689],{"class":678},[318,3679,3680,3682,3684,3687],{"class":320,"line":351},[318,3681,694],{"class":648},[318,3683,675],{"class":652},[318,3685,3686],{"class":678},"America\u002FNew_York",[318,3688,3689],{"class":918},"  # IANA timezone name\n",[271,3691,3692,3695,3697,3698,3701,3702,3705,3706,3710],{},[212,3693,3694],{},"Can I correlate syslog logs with traces?",[3492,3696],{},"\nYes, if your app includes ",[315,3699,3700],{},"trace_id"," and ",[315,3703,3704],{},"span_id"," in syslog messages (e.g. in the structured-data field for RFC 5424). Use an operator to extract them. For native trace correlation, consider using a ",[217,3707,3709],{"href":3708},"\u002Fopentelemetry\u002Flogs#log-trace-correlation","logging bridge"," instead.",[271,3712,3713,3716,3718],{},[212,3714,3715],{},"How do I handle log rotation on the sender side?",[3492,3717],{},"\nSyslog receivers are not affected by log rotation — they receive messages over the network, not from files. Rotation on the sender side is transparent.",[271,3720,3721,3724,3726,3727,3729,3730],{},[212,3722,3723],{},"Is there a message size limit?",[3492,3725],{},"\nRFC 3164 recommends 1024 bytes; RFC 5424 allows up to 2048 bytes by default. The Collector's TCP receiver defaults to ",[315,3728,915],{},". Set explicitly:",[308,3731,3733],{"className":639,"code":3732,"language":641,"meta":313,"style":313},"receivers:\n  syslog:\n    tcp:\n      listen_address: '0.0.0.0:54527'\n      max_log_size: 1MiB\n    protocol: rfc5424\n",[315,3734,3735,3741,3747,3753,3761,3770],{"__ignoreMap":313},[318,3736,3737,3739],{"class":320,"line":321},[318,3738,649],{"class":648},[318,3740,653],{"class":652},[318,3742,3743,3745],{"class":320,"line":327},[318,3744,658],{"class":648},[318,3746,653],{"class":652},[318,3748,3749,3751],{"class":320,"line":333},[318,3750,665],{"class":648},[318,3752,653],{"class":652},[318,3754,3755,3757,3759],{"class":320,"line":339},[318,3756,672],{"class":648},[318,3758,675],{"class":652},[318,3760,679],{"class":678},[318,3762,3763,3765,3767],{"class":320,"line":345},[318,3764,910],{"class":648},[318,3766,675],{"class":652},[318,3768,3769],{"class":678},"1MiB\n",[318,3771,3772,3774,3776],{"class":320,"line":351},[318,3773,684],{"class":648},[318,3775,675],{"class":652},[318,3777,928],{"class":678},[238,3779,3781],{"id":3780},"backend-examples","Backend Examples",[208,3783,3784],{},"This guide uses Uptrace in examples, but OpenTelemetry works with any OTLP-compatible backend:",[363,3786,3788],{"id":3787},"uptrace","Uptrace",[308,3790,3792],{"className":639,"code":3791,"language":641,"meta":313,"style":313},"exporters:\n  otlp\u002Fuptrace:\n    endpoint: api.uptrace.dev:4317\n    headers:\n      uptrace-dsn: 'https:\u002F\u002F\u003Csecret>@api.uptrace.dev?grpc=4317'\n",[315,3793,3794,3800,3806,3814,3820],{"__ignoreMap":313},[318,3795,3796,3798],{"class":320,"line":321},[318,3797,712],{"class":648},[318,3799,653],{"class":652},[318,3801,3802,3804],{"class":320,"line":327},[318,3803,720],{"class":648},[318,3805,653],{"class":652},[318,3807,3808,3810,3812],{"class":320,"line":333},[318,3809,728],{"class":648},[318,3811,675],{"class":652},[318,3813,733],{"class":678},[318,3815,3816,3818],{"class":320,"line":339},[318,3817,739],{"class":648},[318,3819,653],{"class":652},[318,3821,3822,3824,3826],{"class":320,"line":345},[318,3823,747],{"class":648},[318,3825,675],{"class":652},[318,3827,752],{"class":678},[363,3829,3831],{"id":3830},"grafana-cloud","Grafana Cloud",[308,3833,3835],{"className":639,"code":3834,"language":641,"meta":313,"style":313},"exporters:\n  otlp:\n    endpoint: otlp-gateway.grafana.net:443\n    headers:\n      authorization: \"Bearer YOUR_GRAFANA_TOKEN\"\n",[315,3836,3837,3843,3850,3859,3865],{"__ignoreMap":313},[318,3838,3839,3841],{"class":320,"line":321},[318,3840,712],{"class":648},[318,3842,653],{"class":652},[318,3844,3845,3848],{"class":320,"line":327},[318,3846,3847],{"class":648},"  otlp",[318,3849,653],{"class":652},[318,3851,3852,3854,3856],{"class":320,"line":333},[318,3853,728],{"class":648},[318,3855,675],{"class":652},[318,3857,3858],{"class":678},"otlp-gateway.grafana.net:443\n",[318,3860,3861,3863],{"class":320,"line":339},[318,3862,739],{"class":648},[318,3864,653],{"class":652},[318,3866,3867,3870,3872],{"class":320,"line":345},[318,3868,3869],{"class":648},"      authorization",[318,3871,675],{"class":652},[318,3873,3874],{"class":678},"\"Bearer YOUR_GRAFANA_TOKEN\"\n",[363,3876,3878],{"id":3877},"jaeger","Jaeger",[308,3880,3882],{"className":639,"code":3881,"language":641,"meta":313,"style":313},"exporters:\n  otlp:\n    endpoint: jaeger-collector:4317\n    tls:\n      insecure: true\n",[315,3883,3884,3890,3896,3905,3912],{"__ignoreMap":313},[318,3885,3886,3888],{"class":320,"line":321},[318,3887,712],{"class":648},[318,3889,653],{"class":652},[318,3891,3892,3894],{"class":320,"line":327},[318,3893,3847],{"class":648},[318,3895,653],{"class":652},[318,3897,3898,3900,3902],{"class":320,"line":333},[318,3899,728],{"class":648},[318,3901,675],{"class":652},[318,3903,3904],{"class":678},"jaeger-collector:4317\n",[318,3906,3907,3910],{"class":320,"line":339},[318,3908,3909],{"class":648},"    tls",[318,3911,653],{"class":652},[318,3913,3914,3917,3919],{"class":320,"line":345},[318,3915,3916],{"class":648},"      insecure",[318,3918,675],{"class":652},[318,3920,3921],{"class":847},"true\n",[363,3923,3925],{"id":3924},"datadog","Datadog",[308,3927,3929],{"className":639,"code":3928,"language":641,"meta":313,"style":313},"exporters:\n  otlp:\n    endpoint: trace.agent.datadoghq.com:4317\n    headers:\n      dd-api-key: \"YOUR_DATADOG_API_KEY\"\n",[315,3930,3931,3937,3943,3952,3958],{"__ignoreMap":313},[318,3932,3933,3935],{"class":320,"line":321},[318,3934,712],{"class":648},[318,3936,653],{"class":652},[318,3938,3939,3941],{"class":320,"line":327},[318,3940,3847],{"class":648},[318,3942,653],{"class":652},[318,3944,3945,3947,3949],{"class":320,"line":333},[318,3946,728],{"class":648},[318,3948,675],{"class":652},[318,3950,3951],{"class":678},"trace.agent.datadoghq.com:4317\n",[318,3953,3954,3956],{"class":320,"line":339},[318,3955,739],{"class":648},[318,3957,653],{"class":652},[318,3959,3960,3963,3965],{"class":320,"line":345},[318,3961,3962],{"class":648},"      dd-api-key",[318,3964,675],{"class":652},[318,3966,3967],{"class":678},"\"YOUR_DATADOG_API_KEY\"\n",[363,3969,3971],{"id":3970},"multiple-backends","Multiple Backends",[308,3973,3975],{"className":639,"code":3974,"language":641,"meta":313,"style":313},"service:\n  pipelines:\n    logs:\n      receivers: [syslog]\n      processors: [batch]\n      exporters: [otlp\u002Fuptrace, otlp\u002Fdatadog]\n",[315,3976,3977,3983,3989,3995,4005,4015],{"__ignoreMap":313},[318,3978,3979,3981],{"class":320,"line":321},[318,3980,763],{"class":648},[318,3982,653],{"class":652},[318,3984,3985,3987],{"class":320,"line":327},[318,3986,771],{"class":648},[318,3988,653],{"class":652},[318,3990,3991,3993],{"class":320,"line":333},[318,3992,779],{"class":648},[318,3994,653],{"class":652},[318,3996,3997,3999,4001,4003],{"class":320,"line":339},[318,3998,787],{"class":648},[318,4000,790],{"class":652},[318,4002,793],{"class":678},[318,4004,796],{"class":652},[318,4006,4007,4009,4011,4013],{"class":320,"line":345},[318,4008,2724],{"class":648},[318,4010,790],{"class":652},[318,4012,2735],{"class":678},[318,4014,796],{"class":652},[318,4016,4017,4019,4021,4023,4025,4028],{"class":320,"line":351},[318,4018,802],{"class":648},[318,4020,790],{"class":652},[318,4022,807],{"class":678},[318,4024,2732],{"class":652},[318,4026,4027],{"class":678},"otlp\u002Fdatadog",[318,4029,796],{"class":652},[205,4031,4032],{},[208,4033,4034,4037,4038,4042],{},[212,4035,4036],{},"More backends:"," See the ",[217,4039,4041],{"href":4040},"\u002Fblog\u002Fopentelemetry-backend","OpenTelemetry backends"," guide for a full list of compatible platforms.",[238,4044,4046],{"id":4045},"whats-next","What's next?",[208,4048,4049],{},"With the Syslog Receiver configured, your infrastructure logs flow into OpenTelemetry alongside application traces and metrics.",[208,4051,4052],{},"Next steps:",[268,4054,4055,4062,4067,4075,4083,4091],{},[271,4056,4057,4058,4061],{},"Learn about ",[217,4059,4060],{"href":231},"OpenTelemetry Logs"," for the complete logging picture",[271,4063,4064,4065],{},"Collect file-based logs with the ",[217,4066,261],{"href":50},[271,4068,4069,4070,4074],{},"Follow ",[217,4071,4073],{"href":4072},"\u002Fglossary\u002Fstructured-logging","structured logging best practices"," to get more value from log data",[271,4076,4077,4078,4082],{},"Correlate logs with ",[217,4079,4081],{"href":4080},"\u002Fopentelemetry\u002Fdistributed-tracing","distributed traces"," for faster debugging",[271,4084,4085,4086,4090],{},"Monitor your infrastructure ",[217,4087,4089],{"href":4088},"\u002Fopentelemetry\u002Fmetrics","metrics"," alongside logs",[271,4092,4093,4094,4099],{},"See the ",[217,4095,4098],{"href":4096,"rel":4097},"https:\u002F\u002Fgithub.com\u002Fopen-telemetry\u002Fopentelemetry-collector-contrib\u002Ftree\u002Fmain\u002Freceiver\u002Fsyslogreceiver",[249],"official Syslog Receiver docs"," for all configuration options",[4101,4102,4103],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}",{"title":313,"searchDepth":339,"depth":327,"links":4105},[4106,4107,4111,4112,4117,4122,4126,4132,4135,4140,4146,4150,4151,4158],{"id":240,"depth":327,"text":241},{"id":357,"depth":327,"text":358,"children":4108},[4109,4110],{"id":365,"depth":333,"text":366},{"id":474,"depth":333,"text":475},{"id":605,"depth":327,"text":606},{"id":866,"depth":327,"text":867,"children":4113},[4114,4115,4116],{"id":870,"depth":333,"text":871},{"id":931,"depth":333,"text":932},{"id":1000,"depth":333,"text":1001},{"id":1090,"depth":327,"text":1091,"children":4118},[4119,4120,4121],{"id":1097,"depth":333,"text":1098},{"id":1216,"depth":333,"text":1217},{"id":1236,"depth":333,"text":1237},{"id":1246,"depth":327,"text":1247,"children":4123},[4124,4125],{"id":1253,"depth":333,"text":1098},{"id":1268,"depth":333,"text":1269},{"id":1310,"depth":327,"text":1311,"children":4127},[4128,4129,4130,4131],{"id":1320,"depth":333,"text":1321},{"id":1418,"depth":333,"text":1419},{"id":1525,"depth":333,"text":1526},{"id":1636,"depth":333,"text":1637},{"id":1729,"depth":327,"text":1730,"children":4133},[4134],{"id":1740,"depth":333,"text":1741},{"id":2244,"depth":327,"text":2245,"children":4136},[4137,4138,4139],{"id":2248,"depth":333,"text":2249},{"id":2350,"depth":333,"text":2351},{"id":2475,"depth":333,"text":2476},{"id":2761,"depth":327,"text":2762,"children":4141},[4142,4143,4144,4145],{"id":2765,"depth":333,"text":2766},{"id":3048,"depth":333,"text":3049},{"id":3115,"depth":333,"text":3116},{"id":3208,"depth":333,"text":3209},{"id":3284,"depth":327,"text":3285,"children":4147},[4148,4149],{"id":3288,"depth":333,"text":3289},{"id":3411,"depth":333,"text":3412},{"id":3461,"depth":327,"text":3462},{"id":3780,"depth":327,"text":3781,"children":4152},[4153,4154,4155,4156,4157],{"id":3787,"depth":333,"text":3788},{"id":3830,"depth":333,"text":3831},{"id":3877,"depth":333,"text":3878},{"id":3924,"depth":333,"text":3925},{"id":3970,"depth":333,"text":3971},{"id":4045,"depth":327,"text":4046},"2026-04-05T00:00:00.000Z","Complete guide to the OpenTelemetry Syslog Receiver. Configure TCP\u002FUDP collection, RFC 3164 and RFC 5424 parsing, rsyslog and syslog-ng forwarding, and Kubernetes syslog integration.","md","\u002Fguides\u002Fopentelemetry-syslog-receiver\u002Fcover.webp",{"keyword_difficulty":4164,"readingTime":4165},"medium",{"text":4166,"minutes":4167,"time":4168,"words":4169},"11 min read",10.07,604200,2014,{"title":185,"description":4160},"L4T0U2D4GPgLLk7Src2Ib9pRD08mdwn4zUN5sUI0M7c",[4173,4175],{"title":181,"path":182,"stem":183,"description":4174,"children":-1},"Learn how to implement OpenTelemetry in Symfony applications with step-by-step setup, auto-instrumentation, custom spans, metrics, and production configuration for PHP observability.",{"title":189,"path":190,"stem":191,"description":4176,"children":-1},"Monitor Apache Tomcat with OpenTelemetry Java Agent. Step-by-step setup for automatic tracing, JVM metrics, servlet instrumentation, and production deployment.",{"id":4178,"node_id":4179,"name":3787,"full_name":4180,"private":4181,"owner":4182,"html_url":4199,"description":4200,"fork":4181,"url":4201,"forks_url":4202,"keys_url":4203,"collaborators_url":4204,"teams_url":4205,"hooks_url":4206,"issue_events_url":4207,"events_url":4208,"assignees_url":4209,"branches_url":4210,"tags_url":4211,"blobs_url":4212,"git_tags_url":4213,"git_refs_url":4214,"trees_url":4215,"statuses_url":4216,"languages_url":4217,"stargazers_url":4218,"contributors_url":4219,"subscribers_url":4220,"subscription_url":4221,"commits_url":4222,"git_commits_url":4223,"comments_url":4224,"issue_comment_url":4225,"contents_url":4226,"compare_url":4227,"merges_url":4228,"archive_url":4229,"downloads_url":4230,"issues_url":4231,"pulls_url":4232,"milestones_url":4233,"notifications_url":4234,"labels_url":4235,"releases_url":4236,"deployments_url":4237,"created_at":4238,"updated_at":4239,"pushed_at":4240,"git_url":4241,"ssh_url":4242,"clone_url":4243,"svn_url":4199,"homepage":4244,"size":4245,"stargazers_count":4246,"watchers_count":4246,"language":4247,"has_issues":705,"has_projects":705,"has_downloads":705,"has_wiki":705,"has_pages":4181,"has_discussions":705,"forks_count":4248,"mirror_url":200,"archived":4181,"disabled":4181,"open_issues_count":4249,"license":4250,"allow_forking":705,"is_template":4181,"web_commit_signoff_required":4181,"has_pull_requests":705,"pull_request_creation_policy":4256,"topics":4257,"visibility":4198,"forks":4248,"open_issues":4249,"watchers":4246,"default_branch":4271,"temp_clone_token":200,"custom_properties":4272,"organization":4273,"network_count":4248,"subscribers_count":2009},440841550,"R_kgDOGka1Tg","uptrace\u002Fuptrace",false,{"login":3787,"id":4183,"node_id":4184,"avatar_url":4185,"gravatar_id":313,"url":4186,"html_url":4187,"followers_url":4188,"following_url":4189,"gists_url":4190,"starred_url":4191,"subscriptions_url":4192,"organizations_url":4193,"repos_url":4194,"events_url":4195,"received_events_url":4196,"type":4197,"user_view_type":4198,"site_admin":4181},64948717,"MDEyOk9yZ2FuaXphdGlvbjY0OTQ4NzE3","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F64948717?v=4","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace","https:\u002F\u002Fgithub.com\u002Fuptrace","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Ffollowers","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Ffollowing{\u002Fother_user}","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Fgists{\u002Fgist_id}","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Fstarred{\u002Fowner}{\u002Frepo}","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Fsubscriptions","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Forgs","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Frepos","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Fevents{\u002Fprivacy}","https:\u002F\u002Fapi.github.com\u002Fusers\u002Fuptrace\u002Freceived_events","Organization","public","https:\u002F\u002Fgithub.com\u002Fuptrace\u002Fuptrace","Open source APM: OpenTelemetry traces, metrics, and logs","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fforks","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fkeys{\u002Fkey_id}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fcollaborators{\u002Fcollaborator}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fteams","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fhooks","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fissues\u002Fevents{\u002Fnumber}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fevents","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fassignees{\u002Fuser}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fbranches{\u002Fbranch}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Ftags","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fgit\u002Fblobs{\u002Fsha}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fgit\u002Ftags{\u002Fsha}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fgit\u002Frefs{\u002Fsha}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fgit\u002Ftrees{\u002Fsha}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fstatuses\u002F{sha}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Flanguages","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fstargazers","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fcontributors","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fsubscribers","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fsubscription","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fcommits{\u002Fsha}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fgit\u002Fcommits{\u002Fsha}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fcomments{\u002Fnumber}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fissues\u002Fcomments{\u002Fnumber}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fcontents\u002F{+path}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fcompare\u002F{base}...{head}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fmerges","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002F{archive_format}{\u002Fref}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fdownloads","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fissues{\u002Fnumber}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fpulls{\u002Fnumber}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fmilestones{\u002Fnumber}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fnotifications{?since,all,participating}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Flabels{\u002Fname}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Freleases{\u002Fid}","https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuptrace\u002Fuptrace\u002Fdeployments","2021-12-22T11:53:18Z","2026-04-07T03:53:19Z","2026-03-13T23:34:49Z","git:\u002F\u002Fgithub.com\u002Fuptrace\u002Fuptrace.git","git@github.com:uptrace\u002Fuptrace.git","https:\u002F\u002Fgithub.com\u002Fuptrace\u002Fuptrace.git","https:\u002F\u002Fuptrace.dev\u002Fget\u002Fhosted\u002Fopen-source-apm",5919,4160,"Go",201,37,{"key":4251,"name":4252,"spdx_id":4253,"url":4254,"node_id":4255},"agpl-3.0","GNU Affero General Public License v3.0","AGPL-3.0","https:\u002F\u002Fapi.github.com\u002Flicenses\u002Fagpl-3.0","MDc6TGljZW5zZTE=","all",[4258,4259,4260,4261,4262,4263,4089,4264,4265,4266,4267,4268,4269,4270],"apm","application-monitoring","clickhouse","distributed-tracing","golang","logs","monitoring","observability","opentelemetry","performance-monitoring","self-hosted","tracing","vue","master",{},{"login":3787,"id":4183,"node_id":4184,"avatar_url":4185,"gravatar_id":313,"url":4186,"html_url":4187,"followers_url":4188,"following_url":4189,"gists_url":4190,"starred_url":4191,"subscriptions_url":4192,"organizations_url":4193,"repos_url":4194,"events_url":4195,"received_events_url":4196,"type":4197,"user_view_type":4198,"site_admin":4181},1775561037086]