TLDR Toto asked about setting up OpenObserve to ingest logs using syslog in cloud tenant. Prabhat recommended setting up a local fluentbit or vector server and forwarding syslog, as syslog is not directly supported due to lack of authentication. They also provided help with vector configuration.
syslog is not supported directly in cloud
You must use fluentbit/vector as a local server and then forward using it if you want to use cloud for sending syslog
else you must host opensobserve on your own
the reason for this is that syslog protocol does not support authentication
and we cannot open something on internet that has no authentication
Thanks
are you planing to send logs directly from network devices?
or from your servers?
from network devices, opnsense
you should setup a local fluentbit that can act as a syslog server and can forward logs to openObserve cloud
Here are the docs -
Let us know if that helps, we can help you configure it
Your config file would look like
yup thank you. I got that from your initial reply above
however I'm working with vector instead of fluent bit .. any preference here?
nah, both are good.
while configuring vector to receive syslog msgs, it requires configuring a socket. I'm trying to understand what's used for.
```path = "/path/to/socket"```
is this socket a temporary file to process the msgs before sending them out ?
path is the unix domain socket that will be used to receive syslog messages
possible values are
```/dev/log or /var/run/syslog.sock```
you need the path parameter only if you are using tcp
if you set the mode to UDP then you don't need it
I suggest you go ahead with mode "udp"
Ok, will test that, and let u know, thanks
So I managed to ship the logs. How can I search for all message containing a certain string ?
Check the syntax guide button.
above the query editor
for full text search on a specific field you may need to enable it in the stream details
Toto
Fri, 09 Jun 2023 07:37:44 UTCHey guys, trying to test OpenObserve to ingest logs using syslog as documented here
However, when I log in to my cloud tenant, I don't see the syslog option. Any thoughts? Thanks