Send messages to Falcon LogScale

Starting with version 4.3.0, AxoSyslog can send messages to Falcon LogScale using its Ingest Structured Data API. That way you don’t have to parse the data on Falcon LogScale, because AxoSyslog already sends it in a structured format that LogScale understands and can show in a structured manner as separate columns. For a tutorial on using this destination in Kubernetes, see the From syslog-ng to LogScale: structured logs from any source blog post.

Prerequisites

  • Create an Ingest token for AxoSyslog to use in the token() option of the destination. This token is specific to a LogScale repository.

Ingest Structured Data API

The logscale() destination feeds LogScale via the Ingest Structured Data API.

Minimal configuration:

destination d_logscale {
  logscale(
    token("your-logscale-ingest-token")
  );
};

This driver is actually a reusable configuration snippet configured to send log messages using the http() driver using a template. You can find the source of this configuration snippet on GitHub.

Options

The following options are specific to the logscale() destination. But since this destination is based on the http() destination, you can use the options of the http() destination as well if needed.

attributes()

Type:string
Default:"--scope rfc5424 --exclude MESSAGE --exclude DATE --leave-initial-dot"

Description: A JSON object representing key-value pairs for the LogScale Event, formatted as AxoSyslog value-pairs. By default, the logscale() destination sends the RFC5424 fields as attributes. If you want to send different fields, override the default template.

content-type()

Type:string
Default:"application/json"

Description: The content-type of the HTTP request.

extra-headers()

Type:string
Default:

Description: Extra headers for the HTTP request.

rawstring()

Type:template
Default:${MESSAGE}

Description: Accepts a template that you can use to format the LogScale event.

timestamp()

Type:template
Default:${S_ISODATE}

Description: The timestamp added to the LogScale event.

timezone()

Type:string
Default:

Description: The timezone of the event.

url()

Type:string
Default:"https://cloud.humio.com"

Description: The URL of the LogScale Ingest API.

Last modified June 4, 2024: More github link updates (13f3206)