Elasticsearch data stream, APT repository in AxoSyslog 4.8

Version 4.8 of AxoSyslog is our first independent release since AxoSyslog became a real syslog-ng™ fork (syslog-ng is a trademark of One Identity). The release brings you a new destination for Elasticsearch data streams, an own APT repository to effortlessly install AxoSyslog on Debian and Ubuntu-based systems, and numerous bug fixes for issues reported in the AxoSyslog and the syslog-ng projects.

• Packages are available for Debian and Ubuntu from our APT repository.
• RPM packages are available in the Assets section of the GitHub Releases page (we’re working on an RPM repository as well, and hope to have it up and running for the next release). See our blog post for details on installing AxoSyslog on RHEL, AlmaLinux, or Fedora!
  
• We also provide cloud-ready container images and Helm charts.
• AxoSyslog 4.8 is a binary compatible drop-in replacement for syslog-ng, up to version 4.7.1 (and possibly newer).

We cover the highlights of the release in this post, for the in-depth details of every change, read the release notes on the GitHub Releases page. You can also find them in the AxoSyslog documentation.

UPDATE: AxoSyslog 4.9 has been released, don’t forget to check it!

With the new elasticsearch-datastream() destination of AxoSyslog 4.8 you can feed Elasticsearch data streams to store your log and metrics data as time series data. The following is a sample configuration:

elasticsearch-datastream(
  url("https://elastic-endpoint:9200/my-data-stream/_bulk")
  user("elastic")
  password("ba3DIlk345hjhfEP748V8RZ")
);

gRPC headers

The gRPC based destination drivers can now add static gRPC headers to every RPC call using the new headers() option. For example:

opentelemetry(
  ...
  headers(
    "organization" => "Axoflow"
    "stream-name" => "axo-stream"
  )
);

The following drivers support the new option: bigquery() destination, loki() destination, opentelemetry() destination.

Server-side encryption options for S3 destination

You can specify a KMS key for server-side encryption in the Amazon S3 destination. Special thanks to akunszt for contributing this feature!

You can reference the key using:

destination d_s3 {
  s3(
    bucket("log-archive-bucket")
    object-key("logs/syslog")
    server-side-encryption("aws:kms")
    kms-key("alias/log-archive")
  );
};

To use the aws:kms encryption, the AWS Role or User must have the following permissions on the given key:

• kms:Decrypt
• kms:Encrypt
• kms:GenerateDataKey

The s3() destination now also has a new metric called syslogng_output_event_bytes_total.

APT repository

wget -qO - https://pkg.axoflow.io/axoflow-code-signing-pub.asc | gpg --dearmor > /usr/share/keyrings/axoflow-code-signing-pub.gpg
echo "deb [signed-by=/usr/share/keyrings/axoflow-code-signing-pub.gpg] https://pkg.axoflow.io/apt stable ubuntu-noble" | tee --append /etc/apt/sources.list.d/axoflow.list
apt update
apt install axosyslog

For details, see the AxoSyslog documentation.

Summary

This is a smaller release feature-wise, but it follows the same path we’ve worked on before by adding new and improving older features, and also fixing a number of bugs on the way. In addition, the new APT repository and the RPM packages make AxoSyslog more accessible and easier to install. We hope you’ll give it a try. For the complete list of smaller changes and bug fixes, see the release notes. Stay tuned for more exciting features in the upcoming releases!

Thank you for everyone contributing with bug reports, feature requests, or pull requests. Feedback and any kind of contribution are always appreciated. Visit AxoSyslog GitHub page or join Axoflow’s Discord server to reach out to us, or subscribe to the Axoflow newsletter to receive updates about AxoSyslog and our observability and logging-related products.

For an overview on how our platform enhances syslog-ng based log collection with metrics, see the Metrics for syslog-ng based log management infrastructures blog post.