Parameters of the AxoSyslog Helm chart

The following tables list the configurable parameters of the axosyslog Helm chart and their default values. For details on installing the chart, see Install AxoSyslog with Helm.

The chart has two components that you can enable or disable independently:

• The collector is a DaemonSet that runs on every node, collects the pod logs, and forwards them to a destination. By default, it forwards the logs to the aggregator.
• The aggregator is a StatefulSet that receives syslog and axosyslog-otlp() messages from the network (including the messages of the collector), and routes them to local or remote destinations.

Collector parameters

When you deploy AxoSyslog as a collector (which is a DaemonSet), it collects and forwards local logs to a destination. You can use the following parameters to configure the collector. The parameters for specific destinations are shown in subsequent sections.

The following example uses the collector.config.raw parameter to configure a custom destination:

collector:
  config:
    raw: |
      @version: 4.28.0
      @include "scl.conf"

      log {
        source {
          syslog(port(12345));
        };

        destination {
          logscale(
            token("<YOUR_INGEST_TOKEN>")
          );
        };

        flags(flow-control);
      };

  hostNetworking: true

Collector syslog destination

Send logs over the network, conforming to RFC3164 using the network() destination driver. By default, the collector uses this destination to send the logs to the aggregator in JSON format.

For example, to send the logs to a syslog server outside the cluster:

collector:
  config:
    destinations:
      syslog:
        enabled: true
        transport: tcp
        address: 192.0.2.10
        port: 514
        template: "$(format-json .*)"

Collector OpenSearch destination

Send logs to OpenSearch over HTTP or HTTPS.

For example:

collector:
  config:
    destinations:
      syslog:
        enabled: false
      opensearch:
        enabled: true
        url: http://my-release-opensearch.default.svc.cluster.local:9200
        index: "test-axoflow-index"
        tls:
          CAFile: "/path/to/CAFile.pem"
          Cert: "/path/to/Cert.pem"
          Key: "/path/to/Key.pem"
          peerVerify: true

Collector axosyslogOtlp destination

Send logs to another AxoSyslog node using the axosyslog-otlp() destination driver.

For example, to send the logs to the aggregator using axosyslog-otlp() instead of syslog:

collector:
  config:
    destinations:
      syslog:
        enabled: false
      axosyslogOtlp:
        enabled: true

Other collector parameters

Aggregator parameters

When you deploy AxoSyslog as an aggregator (which is a StatefulSet), it receives incoming data from the network and routes it to a local or remote destination. You can use the following parameters to configure the aggregator. The parameters for specific sources and destinations are shown in subsequent sections.

Aggregator syslog source

You can use the syslog source to receive RFC3164 or RFC5424 formatted syslog messages. The source uses the default-network-drivers() source driver. The following table shows the ports where the aggregator receives the messages:

The NodePorts are used only if service.type is NodePort or LoadBalancer. If needed, you can open additional ports using the service.extraPorts option.

Aggregator axosyslogOtlp source

Initializes an axosyslog-otlp() source to receive messages from another AxoSyslog node that sends telemetry data using the axosyslog-otlp() destination driver. The source receives the messages on port 4317 (container and service port).

Aggregator file destination

To write the received logs into files, configure the aggregator.logFileStorage and the aggregator.config.destinations.file options.

For example:

aggregator:
  enabled: true
  logFileStorage:
    enabled: true
    storageClass: standard
    size: 50Gi
  config:
    destinations:
      file:
        enabled: true
        path: "/var/log/$HOST/syslog"
        extraOptionsRaw: "create-dirs(yes)"

Aggregator OpenSearch destination

Send logs to OpenSearch over HTTP or HTTPS.

For example:

aggregator:
  enabled: true
  bufferStorage:
    enabled: true
    storageClass: standard
    size: 10Gi
  config:
    destinations:
      opensearch:
        enabled: true
        url: http://my-release-opensearch.default.svc.cluster.local:9200
        index: "test-axoflow-index"
        user: "<YOUR_USERNAME>"
        password: "<YOUR_PASSWORD>"
        #tls:
        #  CAFile: "/path/to/CAFile.pem"
        #  CADir: "/path/to/CADir/"
        #  Cert: "/path/to/Cert.pem"
        #  Key: "/path/to/Key.pem"
        #  peerVerify: false
        extraOptionsRaw: "time-reopen(10)"

Aggregator syslog destination

Send logs over the network, conforming to RFC3164 using the network() destination driver.

For example:

aggregator:
  enabled: true
  bufferStorage:
    enabled: true
    storageClass: standard
    size: 10Gi
  config:
    destinations:
      syslog:
        enabled: true
        transport: tcp
        address: 192.0.2.10
        port: 514
        # convert incoming data to JSON
        #template: "$(format-json .*)\n"
        # use standard syslog logfile
        #template: "$ISODATE $HOST $MSGHDR$MSG\n"
        extraOptionsRaw: "time-reopen(10)"

Aggregator axosyslogOtlp destination

Send data using the axosyslog-otlp() destination driver to another AxoSyslog node.

For example:

aggregator:
  enabled: true
  bufferStorage:
    enabled: true
    storageClass: standard
    size: 10Gi
  config:
    destinations:
      axosyslogOtlp:
        enabled: true
        url: "192.0.2.10:4317"
        extraOptionsRaw: "time-reopen(1) batch-timeout(1000) batch-lines(1000)"

Other aggregator parameters

Metrics parameters

You can deploy axosyslog-metrics-exporter as a sidecar container of the collector to expose the metrics of AxoSyslog in Prometheus format on port 9577. If you use the Prometheus Operator, you can also deploy a PodMonitor to scrape the metrics.

Generic chart parameters

The following parameters apply to both the collector and the aggregator. Where a component has its own parameter with the same name (for example, collector.resources or aggregator.resources), the component-level setting overrides the generic one.