Integrating Syslog-ng with OpenObserve

dch

are there plans to support syslog-ng as source?

Prabhat

syslog-ng supports sending data to elasticsearch using _bulk API. The same can be used to send data from syslog-ng to OpenObserve

dch

thanks - is the API then?

dch

and I would need to align syslog-ng format with that?

dch

like so, apparently

Prabhat

Yes.

Prabhat

also

Prabhat

Prabhat

this the_bulk API in OpenObserve

dch

ok thats an excellent find - zinc was the old product name?

Prabhat

yes we built zinc earlier and then built OpenObserve

Prabhat

dch

ok cool so you kept the external api and what you learned, and moved it to rust + sled. nice.

Prabhat

yes. We applied things we learnt with zinc in OpenObserve building it specifically for observability as opposed to a general purpose text search tool.

dch

ok, that url from syslog-ng team works perfectly.

dch

what I am not sure on, is how to delete the "Demo Organisation" in my cloud dashboard, and for the events to go into the custom organisation I created

dch

but at least we have events now

dch

oh,

dch

no these are just "demo" events, not real ones.

Prabhat

> what I am not sure on, is how to delete the "Demo Organisation" in my cloud dashboard, and for the events to go into the custom organisation I created Are you using OpenObserve cloud or self hosted ?

Prabhat

in cloud its just demo data

Prabhat

You should ingest data in your own org

Prabhat

and change org accordingly.

Prabhat

I think we should have one more entry for syslog-ng just like filebeat and others

Prabhat

you can copy the details from filebeat for now for syslog-ng

Mark

I’m also working on an openobserve native syslog-ng destination; early progress is very promising. Basing it on the (very capable, and OSS) Splunk Connect for Syslog, which does a wonderful job classifying data — which makes querying on openobserve a breeze.