destination: Forward, send, and store log messages

A destination is where a log message is sent if the filtering rules match. Similarly to sources, destinations consist of one or more drivers, each defining where and how messages are sent.

To define a destination, add a destination statement to the syslog-ng.conf configuration file using the following syntax:

   destination <identifier> {
        destination-driver(params); destination-driver(params); ...

Example: A simple destination statement

The following destination statement sends messages to the TCP port 1999 of the host.

   destination d_demo_tcp {
        network("" port(1999));

If name resolution is configured, you can use the hostname of the target server as well.

   destination d_tcp {
        network("target_host" port(1999));

The following table lists the destination drivers available in AxoSyslog. If these destinations do not satisfy your needs, you can extend AxoSyslog and write your own destination, for example, in C, Java, or Python. For details, see Write your own custom destination in Java or Python.

The following destination driver groups are available in AxoSyslog:

amqp: Publish messages using AMQP

Send data to Google BigQuery

collectd: Send metrics to collectd

discord: Send alerts and notifications to Discord

elasticsearch2: DEPRECATED - Send messages directly to Elasticsearch version 2.0 or higher

elasticsearch-http: Send messages to Elasticsearch HTTP Bulk API

file: Store messages in plain-text files

Send data to Google Pub/Sub

graphite: Send metrics to Graphite

graylog2: Send logs to Graylog

hdfs: Store messages on the Hadoop Distributed File System (HDFS)

java: Post messages over HTTP using Java

http: Post messages over HTTP without Java

kafka: Publish messages to Apache Kafka (Java implementation)

kafka-c(): Publish messages to Apache Kafka (C implementation)

loggly: Send logs to Loggly

logmatic: Send logs to

Send messages to Falcon LogScale

loki: Grafana Loki

mongodb(): Store messages in a MongoDB database

mqtt(): Send messages from a local network to an MQTT broker

network: Send messages to a remote log server using the RFC3164 protocol (network() driver)

Send messages to OpenObserve

opensearch: Send messages to OpenSearch

osquery: Send log messages to osquery's syslog table

Send logs, metrics, and traces to OpenTelemetry

pipe: Send messages to named pipes

program: Send messages to external applications


python: Write custom Python destinations

redis: Store name-value pairs in Redis

riemann: Monitor your data with Riemann

s3: Amazon S3

slack: Send alerts and notifications to a Slack channel

smtp: Generate SMTP messages (emails) from logs

snmp: Send SNMP traps

splunk-hec-event: Send messages to Splunk HEC

sql: Store messages in an SQL database

stdout: Send messages to standard output

stomp: Publish messages using STOMP

Sumo Logic destinations: sumologic-http() and sumologic-syslog()

syslog: Send messages to a remote logserver using the IETF-syslog protocol

syslog-ng(): Forward logs to another syslog-ng node

syslog-ng-otlp(): Forward logs to another node using OpenTelemetry

tcp, tcp6, udp, udp6: OBSOLETE - Send messages to a remote log server using the legacy BSD-syslog protocol (tcp(), udp() drivers)

telegram: Send messages to Telegram

unix-stream, unix-dgram: Send messages to UNIX domain sockets

usertty: Send messages to a user terminal

Write your own custom destination in Java or Python

Client-side failover