Send messages to Falcon LogScale

AxoSyslog can send messages to Falcon LogScale using its Ingest Structured Data API. That way you don’t have to parse the data on Falcon LogScale, because AxoSyslog already sends it in a structured format that LogScale understands and can show in a structured manner as separate columns. For a tutorial on using this destination in Kubernetes, see the From syslog-ng to LogScale: structured logs from any source blog post.

Prerequisites

AxoSyslog version 4.3 or later.
Install the axosyslog-scl package on Debian/Ubuntu. On RHEL and compatible distributions, the SCL files are part of the axosyslog base package.

Your configuration must also contain @include "scl.conf", which the default configuration file already does. If the SCL files are missing, AxoSyslog fails to start with an unexpected LL_IDENTIFIER error.
Terminal window
```
@include "scl.conf"
```
The logscale() driver is a reusable configuration snippet (SCL). For details on using or writing such configuration snippets, see Reusing configuration blocks. You can find its source in scl/logscale/logscale.conf on GitHub.
This feature requires a separate module. Install the axosyslog-mod-http package on Debian/Ubuntu, or the axosyslog-http package on RHEL and compatible distributions. If the module isn’t installed, AxoSyslog fails to start with an unexpected LL_IDENTIFIER error.
Create an Ingest token for AxoSyslog to use in the token() option of the destination. This token is specific to a LogScale repository.

Ingest Structured Data API

The logscale() destination feeds LogScale via the Ingest Structured Data API.

Minimal configuration:

@include "scl.conf"
# ...

destination d_logscale {
  logscale(
    token("your-logscale-ingest-token")
  );
};

Options

The following options are specific to the logscale() destination. But since this destination is based on the http() destination, you can use the options of the http() destination as well if needed.

attributes()


Type:	string
Default:	`"--scope rfc5424 --exclude MESSAGE --exclude DATE --leave-initial-dot"`

Description: A JSON object representing key-value pairs for the LogScale Event, formatted as AxoSyslog value-pairs. By default, the logscale() destination sends the RFC5424 fields as attributes. If you want to send different fields, override the default template.

content-type()


Type:	string
Default:	`"application/json"`

Description: The content-type of the HTTP request.

extra-headers()


Type:	string
Default:

Description: Extra headers for the HTTP request.

rawstring()


Type:	template
Default:	`${MESSAGE}`

Description: Accepts a template that you can use to format the LogScale event.

timestamp()


Type:	template
Default:	`${S_ISODATE}`

Description: The timestamp added to the LogScale event.

timezone()


Type:	string
Default:

Description: The timezone of the event.

url()


Type:	string
Default:	`"https://cloud.humio.com"`

Description: The URL of the LogScale Ingest API.