OpenObserve can act as a syslog server. This means that you can send logs to OpenObserve using the syslog protocol. OpenObserve supports both UDP and TCP syslog.
Before you can send logs to OpenObserve, you need to enable OpenObserve to act as a syslog server. This is done by enabling syslog in the
Ingestion > Logs > Syslog section of the OpenObserve UI.
Subnets to allow traffic from
OpenObserve will only accept syslog traffic from the subnets that you specify. You must specify a minimum of 3 things:
- Stream name
You can change the default port number using the following environment variables:
ZO_TCP_PORT- TCP port number to listen on. Default:
ZO_UDP_PORT- TCP port number to listen on. Default:
Select an organization and stream. Then set the subnet to
0.0.0.0.0/0. This config allows accepting syslog data from any IP address.
You can then use the syslog generator script from this repo to test if you are able to accept syslog data in OpenObserve.
Clone the repo
Modify the script
Modify the file with the appropriate IP address.