# AxoSyslog > Documentation for AxoSyslog, the scalable security data processor https://axoflow.com/docs/axosyslog-core/ ## Documentation - [How sources work](https://axoflow.com/docs/axosyslog-core/chapter-sources/section-sources-how-work/index.md): A source is where AxoSyslog receives log messages. Sources consist of one or more drivers, each defining where and how … - [What's new](https://axoflow.com/docs/axosyslog-core/whats-new/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [Arr logs](https://axoflow.com/docs/axosyslog-core/chapter-sources/arr/index.md): Starting with version 4.7.0, AxoSyslog can collect logs of the Lidarr, Prowlarr, Radarr, Readarr, and Sonarr (often … - [Adding metadata from an external file](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/data-enrichment-add-contextual-data/index.md): In AxoSyslog version 3.8 and later, you can use an external database file to add additional metadata to your log … - [amqp: Publish messages using AMQP](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-amqp/index.md): The amqp() driver publishes messages using the AMQP (Advanced Message Queuing Protocol). AxoSyslog supports AMQP … - [amqp() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-amqp/reference-destination-amqp/index.md): The amqp() driver publishes messages using the AMQP (Advanced Message Queuing Protocol). The amqp() destination has the … - [Apache access log parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/apache-access-log-parser/index.md): The Apache access log parser can parse the access log messages of the Apache HTTP Server. The AxoSyslog application can … - [Assigning timezone to the message](https://axoflow.com/docs/axosyslog-core/chapter-concepts/timezone-handling/procedure-associating-timezone/index.md): When AxoSyslog receives a message, it assigns timezone information to the message using the following algorithm. The … - [Batch mode and load balancing](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch-http/elasticsearch-http-batch-mode/index.md): The elasticsearch-http() destination automatically sends multiple log messages in a single HTTP request, increasing the … - [Batch mode and load balancing](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/http-batch-mode/index.md): Starting with version 3.18, you can send multiple log messages in a single HTTP request if the destination HTTP server … - [Batch mode and load balancing](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-redis/destination-redis-batch/index.md): Starting with version 3.34, you can send multiple log messages with the help of Redis’s pipelining feature. Batch … - [Batch mode and load balancing](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-opensearch/batch-mode/index.md): The opensearch() destination automatically sends multiple log messages in a single HTTP request, increasing the rate of … - [BSD-syslog or legacy-syslog messages](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-message-structure/concepts-message-bsdsyslog/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [CEF](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/cef/index.md): Available in AxoSyslog 4.9 and later. The parse_cef FilterX function parses messages formatted in the Common Event … - [Change an old destination driver to the network() driver](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-tcpudp/reference-destination-tcpudp/destination-tcpudp-to-network/index.md): To replace your existing tcp(), tcp6(), udp(), udp6() destinations with a network() destination, complete the following … - [Change an old source driver to the network() driver](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-tcpudp/reference-source-tcpudp/source-tcpudp-to-network/index.md): To replace your existing tcp(), tcp6(), udp(), udp6() sources with a network() source, complete the following steps. … - [Parameters of the AxoSyslog Helm chart](https://axoflow.com/docs/axosyslog-core/install/helm/helm-chart-parameters/index.md): The following table lists the configurable parameters of the AxoSyslog collector chart and their default values. For … - [Classifying log messages](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/concepts-pattern-databases/index.md): The AxoSyslog application can compare the contents of the received log messages to predefined message patterns. By … - [Client mode](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-modes-of-operation/concepts-client-mode/index.md): In client mode, AxoSyslog collects the local logs generated by the host and forwards them through a network connection … - [collectd() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-collectd/destination-collectd-options/index.md): The collectd() destination has the following options. The plugin() and type() options are required options. You can … - [Conditional actions](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/patterndb-triggers-actions/patterndb-actions-conditional/index.md): To limit when a message is triggered, use the condition attribute and specify a filter expression: the action will be … - [Configuring AxoSyslog on client hosts](https://axoflow.com/docs/axosyslog-core/quickstart/configure-clients/index.md): Purpose:To configure AxoSyslog on a client host, complete the following steps. Steps: Install the AxoSyslog application … - [Configuring AxoSyslog on relay hosts](https://axoflow.com/docs/axosyslog-core/quickstart/relaying-log-messages/procedure-configuring-syslog-ng-relays/index.md): To configure AxoSyslog on a relay host, complete the following steps: Install the AxoSyslog application on the host. … - [Configuring global options](https://axoflow.com/docs/axosyslog-core/chapter-global-options/options/index.md): The syslog-ng application has a number of global options governing DNS usage, the timestamp format used, and other … - [Configuring TLS on the AxoSyslog clients](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tls-mutualauth/procedure-configuring-mutual-tls-client/index.md): Purpose:Complete the following steps on every AxoSyslog client host. Examples are provided using both the legacy … - [Configuring TLS on the AxoSyslog clients](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tls-serverauth/procedure-configuring-tls-client/index.md): Purpose:Complete the following steps on every AxoSyslog client host. Examples are provided using both the legacy … - [Connecting to the MongoDB server](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-mongodb/mongodb-connecting-server/index.md): When AxoSyslog connects the MongoDB server during startup, it completes the following steps. The AxoSyslog application … - [Converting Cisco syslog messages to clogMessageGenerated SNMP traps](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-snmp/cisco-syslog-snmp/index.md): The AxoSyslog application can convert the syslog messages sent by Cisco devices to Cisco-specific SNMP traps defined by … - [Correlating messages using the grouping-by() parser](https://axoflow.com/docs/axosyslog-core/chapter-correlating-log-messages/grouping-by-parser/index.md): The AxoSyslog application can correlate log messages that match a set of filters. This works similarly to SQL GROUP BY … - [Customize message format using macros and templates](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/index.md): The following sections describe how to customize the names of logfiles, and also how to use templates, macros, and … - [default-network-drivers() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-default-network-drivers/reference-source-default-network-drivers/index.md): The default-network-drivers() driver has the following options. ca-dir() Accepted values: Directory name Default: none … - [Discord destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-discord/reference-destination-discord/index.md): The discord() destination of AxoSyslog can directly post log messages to web services using the HTTP protocol. The … - [Element: patterndb](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-patterndb/index.md): Location/patterndb DescriptionThe container element of the pattern database. Attributes version: The schema version of … - [Embedded log statements](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/logpath/concepts-embedded-logpaths/index.md): Starting from version 3.0, AxoSyslog can handle embedded log statements (also called log pipes). Embedded log … - [Enabling reliable disk-based buffering](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/configuring-diskbuffer-reliable/index.md): Every destination driver supports the disk-buffer() option. The network(), syslog(), tcp(), and tcp6() destination … - [Example use case: using the $DESTIP, the $DESTPORT, and the $PROTO macros](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/reference-macros/use-case-3-macros/index.md): This section describes scenarios when Axoflow recommends using the $DESTIP, the $DESTPORT, and the $PROTO macros. Using … - [facility()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-facility/index.md): Synopsis: facility(<facility-name>) or facility(<facility-code>) or facility(<facility-name>..<facility-name>) … - [file() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-file/reference-destination-file/index.md): The file() driver outputs messages to the specified text file, or to a set of files. The file() destination has the … - [Flow-control and multiple destinations](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-flow-control/flow-control-multiple-destinations/index.md): Using flow-control on a source has an important side-effect if the messages of the source are sent to multiple … - [Formatting messages, filenames, directories, and tablenames](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/concepts-macro/index.md): The AxoSyslog application can dynamically create filenames, directories, or names of database tables using macros that … - [Fortigate parser options](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-fortigate/parser-fortigate-options/index.md): The fortigate-parser() has the following options: prefix() Synopsis: prefix() Default: “.panos.” Description: Insert a … - [General recommendations](https://axoflow.com/docs/axosyslog-core/chapter-examples/example-general/index.md): This section provides general tips and recommendations on using syslog-ng. Some of the recommendations are detailed in … - [graphite() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-graphite/reference-destination-graphite/index.md): The graphite() destination has the following options: hook-commands()Description: This option makes it possible to … - [graylog2() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-graylog/reference-destination-graylog/index.md): The graylog2() destination has the following options: ca-dir() Accepted values: Directory name Default: none … - [HTTP destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http/reference-destination-http/index.md): The http destination of AxoSyslog can directly post log messages to web services using the HTTP protocol. The http … - [Including configuration files](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/large-configs/including-config-files/index.md): The AxoSyslog application supports including external files in its configuration file, so parts of its configuration … - [Information about disk-buffer files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/get-information-about-disk-buffer-files/get-information-about-disk-buffer-files-info/index.md): This section describes information about disk-buffer files used in AxoSyslog. The following list contains information … - [internal() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-internal/reference-source-internal/index.md): The internal() driver has the following options: host-override() Type: string Default: Description: Replaces the … - [Introduction to AxoSyslog](https://axoflow.com/docs/axosyslog-core/intro/index.md): What AxoSyslog is AxoSyslog is a scalable, open source security data processor by Axoflow. - [kubernetes() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-kubernetes/reference-source-kubernetes/index.md): The kubernetes() source has the following options: base-dir() Type: path without filename Default: /var/log/containers … - [Limitations of the XML parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/xml-parser/xml-parser-limitations/index.md): The XML parser comes with certain limitations. Vector-like structures:It is not possible to address each element of a … - [linux-audit() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-linux-audit/reference-source-linux-audit/index.md): The file() driver has the following options: filename() Type: path Default: Description: The log file of linux-audit. … - [Loading modules](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/modules/modules-loading/index.md): The AxoSyslog application loads every available module during startup. To load a module that is not loaded … - [Location of the configuration file](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/config-file/index.md): To configure AxoSyslog, edit the syslog-ng.conf file with any regular text editor application. The location of the … - [Log paths](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/logpath/index.md): Log paths determine what happens with the incoming log messages. Messages coming from the sources listed in the log … - [loggly() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-loggly/reference-destination-loggly/index.md): The loggly() destination has the following options. You can also set other options of the underlying tcp() driver (for … - [logmatic() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-logmatic/reference-destination-logmatic/index.md): The logmatic() destination has the following options. You can also set other options of the underlying tcp() driver … - [mbox() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-source-mbox/reference-source-mbox/index.md): The mbox() driver has the following option. hook-commands()Description: This option makes it possible to execute … - [Message format parsed by panos-parser()](https://axoflow.com/docs/axosyslog-core/chapter-parsers/panos-parser/panos-parser-m-form/index.md): This section illustrates the most commonly used PAN-OS log format on the AxoSyslog side. For information about … - [Multithreading concepts](https://axoflow.com/docs/axosyslog-core/chapter-multithreading/multithreading-in-syslog-ng/index.md): This section is a brief overview on how AxoSyslog works in multithreaded mode. It is mainly for illustration purposes: … - [MySQL-specific interaction methods](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-sql/sql-interactions-syslog-ng/mysql-specific-interaction-methods/index.md): To specify the socket to use, set and export the MYSQL_UNIX_PORT environment variable, for example, … - [network() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-network/reference-destination-network-chapter/index.md): The network() driver sends messages to a remote host (for example, a server or relay) on the local intranet or internet … - [network() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-network/reference-source-network/index.md): The network() driver has the following options. ca-dir() Accepted values: Directory name Default: none Description: The … - [nodejs() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-source-nodejs/reference-source-nodejs/index.md): The nodejs() driver has the following options. hook-commands()Description: This option makes it possible to execute … - [Notes on reading kernel messages](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-file/kernel-messages/index.md): Note the following points when reading kernel messages on various platforms. The kernel usually sends log messages to a … - [Options of apache-accesslog-parser() parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/apache-access-log-parser/apache-accesslog-options/index.md): The apache-accesslog-parser() has the following options. prefix() Synopsis: prefix() Description: Insert a prefix … - [Options of CSV parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/csv-parser/reference-parsers-csv/index.md): The AxoSyslog application can separate parts of log messages (that is, the contents of the ${MESSAGE} macro) at … - [Options of CSV parsers](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/csv/reference-parsers-csv/index.md): The parse_csv FilterX function has the following options. columns Synopsis: columns=["1st","2nd","3rd"] Default value: … - [Options of date-parser() parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/date-parser/date-parser-options/index.md): The date-parser() parser has the following options. format() Synopsis: format(string) Default: Description: Specifies … - [Options of geoip parsers](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/geoip-parser/geoip-parser-options/index.md): The geoip parser has the following options. prefix() Synopsis: prefix() Description: Insert a prefix before the name … - [Options of JSON parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/json-parser/json-parser-options/index.md): The JSON parser has the following options. extract-prefix() Synopsis: extract-prefix() Description: Extract only the … - [Options of key=value parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/key-value-parser/kv-parser-options/index.md): The kv-parser has the following options. extract-stray-words-into() Synopsis: extract-stray-words-into(") Description: … - [Options of key=value parsers](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/key-value-parser/kv-parser-options/index.md): The parse_kv FilterX function has the following options. pair_separatorSpecifies the character or string that separates … - [Options of linux-audit-parser() parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/linux-audit-parser/linux-audit-parser-options/index.md): The linux-audit-parser() has the following options. prefix() Synopsis: prefix() Description: Insert a prefix before the … - [Options of rate-limit() filter](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-rate-limit/filter-rate-limit-options/index.md): The rate-limit() filter has the following options. key() Type: template Default: empty string Description: The resolved … - [Options of Regular expression parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-regexp/parser-regexp-options/index.md): The Regular expression parser has the following options. flags() Synopsis: flags(“ignore-case” “unicode”) Mandatory: no … - [Options of regular expressions](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/regular-expressions/reference-regexp-types/index.md): This chapter lists regular expressions supported by AxoSyslog and their available supported type() and flags() options. … - [Options of syslog-parser() parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-syslog/parser-syslog-options/index.md): The syslog-parser() has the following options: default-facility() Type: facility string Default: user Description: This … - [osquery() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-osquery/options-osquery/index.md): The osquery() destination has the following options: file() Type: string Default: N/A Description: Specifies a path to … - [osquery() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/syslog-ng-source-osquery/reference-source-osquery/index.md): The osquery() driver has the following options. file() Type: path Default: /var/log/osquery/osqueryd.results.log … - [pacct() options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-pacct/reference-source-pacct/index.md): The pacct() driver has the following options: file() Type: filename with path Default: /var/log/account/pacct … - [Pattern parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/syslog-ng-patterndb-using-parsers/reference-patterndb-parsers/index.md): The following parsers are available in AxoSyslog. The internal parsers (for example, @NUMBER@) automatically associate … - [pipe() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-pipe/reference-destination-pipe/index.md): This driver sends messages to a named pipe like /dev/xconsole. The pipe() destination has the following options: … - [pipe() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-pipe/reference-source-pipe/index.md): The pipe driver has the following options: chain-hostnames() Accepted values: yes, no Default: no Description: Enable … - [Install AxoSyslog with Podman and systemd](https://axoflow.com/docs/axosyslog-core/install/podman-systemd/index.md): This page shows you how to run AxoSyslog as a systemd service using podman. AxoSyslog provides cloud-ready images. … - [Possible causes of losing log messages](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/concepts-losing-messages/index.md): During the course of a message from the sending application to the final destination of the message, there are a number … - [Prerequisites](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch2/destination-elasticsearch2-prerequisites/index.md): To send messages from AxoSyslog to Elasticsearch, complete the following steps. Steps: Download and install the Java … - [Prerequisites](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-hdfs/destination-hdfs-prerequisites/index.md): To send messages from AxoSyslog to HDFS, complete the following steps. Steps: If you want to use the Java-based modules … - [Prerequisites](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka/destination-kafka-prerequisites/index.md): To publish messages from AxoSyslog to Apache Kafka, complete the following steps. Steps: If you want to use the … - [Prerequisites to using the mqtt() destination](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-mqtt-intro/destination-mqtt-prer/index.md): Using the current implementation of the mqtt() destination has the following prerequisites: Installing the … - [Prerequisites to using the mqtt() source](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-mqtt/source-mqtt-prer/index.md): Using the current implementation of the mqtt() source has the following prerequisites: Installing the … - [program() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-program/reference-destination-program/index.md): This driver starts an external application or script and sends the log messages to its standard input (stdin). The … - [program() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-program/reference-source-program/index.md): The program driver has the following options: chain-hostnames() Accepted values: yes, no Default: no Description: … - [pseudofile() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-pseudofile/reference-destination-pseudofile/index.md): The pseudofile() destination has the following options: file() Type: filename with path Default: Description: The file … - [Python LogMessage API](https://axoflow.com/docs/axosyslog-core/chapter-sources/python-source/python-source-logmessage/index.md): The LogMessage API allows you to create LogMessage objects in Python sources, parse syslog messages, and set the … - [python() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/python-destination/reference-destination-python/index.md): The Python destination allows you to write your own destination in Python. The python() destination has the following … - [Referencing earlier messages of the context](https://axoflow.com/docs/axosyslog-core/chapter-correlating-log-messages/grouping-by-parser/referencing-previous-messages-grouping-by/index.md): When creating the aggregated message, or in the various parameters of the grouping-by() parser, you can also refer to … - [Referencing earlier messages of the context](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/configuring-pattern-databases/patterndb-correlation/referencing-previous-messages/index.md): When using the <value> element in pattern database rules together with message correlation, you can also refer to … - [Referring to parts of the message as a macro](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/geoip2-parser/referring-to-parts-of-the-message-as-a-macro/index.md): You can refer to the separated parts of the message using the key of the value as a macro. For example, if the message … - [Replace message parts](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-replace/index.md): To replace a part of the log message, you have to: define a string or regular expression to find the text to replace … - [riemann() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-riemann/reference-destination-riemann/index.md): The riemann() driver sends metrics or events to a Riemann monitoring system. The riemann() destination has the … - [Load balancing with a round robin load balancing method based on the R_MSEC macro](https://axoflow.com/docs/axosyslog-core/chapter-examples/load-bal-multi-dest/load-bal-multi-dest-macro/index.md): This section describes a round robin load balancing method based on the R_MSEC macro of AxoSyslog to load balance your … - [Secure logging using TLS](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/concepts-tls/index.md): The AxoSyslog application can send and receive log messages securely over the network using the Transport Layer … - [Shifting from Java implementation to C implementation](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka-c/destination-kafka-c-from-java/index.md): If you were using the Java implementation of the kafka destination and want to shift to its C implementation, the … - [Slack destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-slack/reference-destination-slack/index.md): The slack destination of AxoSyslog can directly post log messages and notifications to Slack channels. The slack … - [smtp() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-smtp/reference-destination-smtp/index.md): The smtp() sends email messages using SMTP, without needing external applications. The smtp() destination has the … - [snmptrap() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/syslog-ng-source-snmptrap/reference-source-snmptrap/index.md): The snmptrap() driver has the following options. Only the filename() option is required, the others are optional. … - [Specifying data types in value-pairs](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-value-pairs/specifying-data-types/index.md): Prior to version 4.0, AxoSyslog handled every data as strings, and allowed you to convert the strings into other types … - [stdin() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-stdin/stdin-source-options/index.md): The stdin() driver has the following options: chain-hostnames() Accepted values: yes, no Default: no Description: … - [stomp() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-stomp/reference-destination-stomp/index.md): The stomp() driver publishes messages using the Simple (or Streaming) Text Oriented Message Protocol (STOMP). The … - [sumologic-http()](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-sumologic-intro/destination-sumologic-http/index.md): The sumologic-http() and sumologic-syslog() destinations send log messages to Sumo Logic, a cloud-based log management … - [sumologic-http() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-sumologic-intro/destination-sumologic-options/destination-sumologic-options-http/index.md): The sumologic-http() destination supports all HTTP destination options. In addition, the sumologic-http() destination … - [sun-streams() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-sunstreams/reference-source-sunstreams/index.md): The sun-streams() driver has the following options. check-program() Type: yes or no Default: no Description: Available … - [syslog() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-syslog/reference-destination-syslog-chapter/index.md): The syslog() driver sends messages to a remote host (for example, an AxoSyslog server or relay) on the local intranet … - [syslog() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-syslog/reference-source-syslog-chapter/index.md): The syslog() driver has the following options. ca-dir() Accepted values: Directory name Default: none Description: The … - [system() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-system/reference-source-system/index.md): The system() driver has the following options: hook-commands()Description: This option makes it possible to execute … - [systemd-journal() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-journal/reference-source-journal/index.md): The systemd-journal() driver has the following options: chain-hostnames() Accepted values: yes, no Default: no … - [systemd-syslog() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-systemd-syslog/reference-source-systemd-syslog/index.md): The systemd-syslog() driver has the following options: chain-hostnames() Accepted values: yes, no Default: no … - [tcp(), tcp6(), udp() and udp6() source options: OBSOLETE](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-tcpudp/reference-source-tcpudp/index.md): Note The tcp(), tcp6(), udp(), and udp6() drivers are obsolete. Use the network() source and the network() destination … - [tcp(), tcp6(), udp(), and udp6() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-tcpudp/reference-destination-tcpudp/index.md): Note The tcp(), tcp6(), udp(), and udp6() drivers are obsolete. Use the network() source and the network() destination … - [telegram() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-telegram/reference-destinations-telegram/index.md): The telegram() destination has the following options: bot-id() Type: number Default: N/A Description: This is a … - [The philosophy of AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-concepts/syslog-ng-philosophy/index.md): Typically, AxoSyslog is used to manage log messages and implement centralized logging, where the aim is to collect the … - [The route of a log message in AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-logging-with-syslog-ng/concepts-route-of-a-message/index.md): Purpose:The following procedure illustrates the route of a log message from its source on the AxoSyslog client to its … - [The structure of the pattern database](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/concepts-pattern-databases/syslog-ng-patterndb-structure/index.md): The pattern database is organized as follows: The pattern database consists of rulesets. A ruleset consists of a … - [The syslog-ng manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/syslog-ng.8/index.md): Namesyslog-ng — syslog-ng system logger application Synopsissyslog-ng [options] DescriptionThe AxoSyslog application is … - [The working mechanism behind the Proxy Protocol](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-network/proxy-prot-intro/proxy-prot-w-mech/index.md): This section describes how AxoSyslog supports the Proxy Protocol. The working mechanism behind the Proxy ProtocolWhen … - [UNIX credentials and other metadata](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-unixstream/unixstream-unix-credentials/index.md): Starting with AxoSyslog 3.6, the unix-stream() and unix-dgram() sources automatically extract the available UNIX … - [unix-stream() and unix-dgram() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-unixstream/reference-destination-unixstream/index.md): These drivers send messages to a unix socket in either SOCK_STREAM or SOCK_DGRAM mode. The unix-stream() and … - [Using embedded log statements](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/logpath/concepts-embedded-logpaths/using-embedded-log-statements/index.md): Embedded log statements (for details, see Embedded log statements) re-use the results of processing messages (for … - [Using filters](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/configuring-filters/index.md): Filters perform log routing: a message passes the filter if the filter expression is true for the particular message. … - [Using filters as selector](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/data-enrichment-add-contextual-data/add-contextual-data-filters/index.md): To better control to which log messages you add contextual data, you can use filters as selectors. In this case, the … - [Using parser results in filters and templates](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/configuring-pattern-databases/patterndb-filters/index.md): The results of message classification and parsing can be used in custom filters and templates, for example, in file and … - [Using pattern parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/syslog-ng-patterndb-using-parsers/index.md): Pattern parsers attempt to parse a part of the message using rules specific to the type of the parser. Parsers are … - [Using the sql() driver with an Oracle database](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-sql/configuring-sql-oracle/index.md): The Oracle sql destination has some special aspects that are important to note. The hostname of the database server is … - [wildcard-file() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-wildcard-file/reference-source-wildcard-file/index.md): The wildcard-file() driver has the following options: base-dir() Type: path without filename Default: Description: The … - [Send data to Apache Arrow Flight](https://axoflow.com/docs/axosyslog-core/chapter-destinations/arrow-flight/index.md): Starting with version 4.26.0, the arrow-flight() destination can send data to an Apache Arrow Flight server over gRPC. … - [Send data to Azure Monitor and Sentinel](https://axoflow.com/docs/axosyslog-core/chapter-destinations/azure-monitor/index.md): Starting with version 4.10.0, AxoSyslog can send data to Azure Monitor using its HTTP REST Logs ingestion API. Data … - [Send data to Google BigQuery](https://axoflow.com/docs/axosyslog-core/chapter-destinations/google-bigquery/index.md): Starting with version 4.6.0, AxoSyslog can send data to Google Cloud BigQuery via the BigQuery Storage Write API using … - [Collect native macOS system logs](https://axoflow.com/docs/axosyslog-core/chapter-sources/darwin/index.md): Starting with version 4.6.0, AxoSyslog can collect logs on macOS using its native OSLog framework using the … - [Check Point Log Exporter parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-checkpoint/index.md): The Check Point Log Exporter parser can parse Check Point log messages. These messages do not completely comply with … - [ClickHouse database](https://axoflow.com/docs/axosyslog-core/chapter-destinations/clickhouse/index.md): Starting with version 4.9.0, AxoSyslog can send data to ClickHouse databases using its gRPC interface. Prerequisites A … - [Collect metrics with Prometheus](https://axoflow.com/docs/axosyslog-core/chapter-log-statistics/prometheus-exporter/index.md): Export AxoSyslog and syslog-ng metrics to Prometheus using the axosyslog-metrics-exporter and scrape them with … - [Configuration generator for the load balancing method based on MSEC hashing](https://axoflow.com/docs/axosyslog-core/chapter-examples/load-bal-multi-dest/load-bal-multi-dest-msec-h/index.md): This section describes a configuration generator SCL for the load balancing method based on MSEC hashing to load … - [Install AxoSyslog on Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/install/debian-ubuntu/index.md): You can install AxoSyslog 4.8 and newer on your Debian-based system from Axoflow’s APT repository. AxoSyslog is a drop … - [Handling large message load](https://axoflow.com/docs/axosyslog-core/chapter-examples/handling-large-load/index.md): This section provides tips on optimizing the performance of syslog-ng. Optimizing the performance is important for … - [Quick-start guide](https://axoflow.com/docs/axosyslog-core/quickstart/index.md): This chapter provides a very brief introduction into configuring the AxoSyslog application. For details on the format … - [The syslog-ng.conf manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/syslog-ng.conf.5/index.md): Namesyslog-ng.conf — configuration file Synopsissyslog-ng.conf DescriptionThe AxoSyslog application is a flexible and … - [Install AxoSyslog on RHEL/Fedora/AlmaLinux](https://axoflow.com/docs/axosyslog-core/install/rhel-fedora-almalinux/index.md): You can install AxoSyslog 4.8 and newer on your RPM-based system from Axoflow’s RPM repository. AxoSyslog is a drop in … - [Before you begin](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka-c/configuring-destinations-kafka-c-prer-decl/index.md): This section describes the prerequisites and restrictions for using the kafka destination in the new C implementation, … - [Boolean operators in FilterX](https://axoflow.com/docs/axosyslog-core/filterx/filterx-boolean/index.md): When a log statement includes multiple filter statements, AxoSyslog sends a message to the destination only if all … - [Cisco parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/cisco-parser/index.md): The Cisco parser can parse the log messages of various Cisco devices. The messages of these devices often do not … - [collectd: Send metrics to collectd](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-collectd/index.md): The collectd() destination uses the unixsock plugin of the collectd application to send log messages to the collectd … - [Combining filters with boolean operators](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/filters-boolean/index.md): When a log statement includes multiple filter statements, AxoSyslog sends a message to the destination only if all … - [Configuring AxoSyslog on server hosts](https://axoflow.com/docs/axosyslog-core/quickstart/configure-servers/index.md): Purpose:To configure AxoSyslog on a server host, complete the following steps. Steps: Install the AxoSyslog application … - [Configuring flow-control](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-flow-control/configuring-flow-control/index.md): For details on how flow-control works, see Managing incoming and outgoing messages with flow-control. The summary of … - [Configuring multithreading](https://axoflow.com/docs/axosyslog-core/chapter-multithreading/configuring-multithreading/index.md): Starting with version 3.6, AxoSyslog runs in multithreaded mode by default. You can enable multithreading in AxoSyslog … - [Configuring TLS on the AxoSyslog server](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tls-mutualauth/procedure-configuring-mutual-tls-server/index.md): Purpose:Complete the following steps on the AxoSyslog server: Steps: Copy the certificate (for example, syslog-ng.cert) … - [Configuring TLS on the AxoSyslog server](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tls-serverauth/procedure-configuring-tls-server/index.md): Purpose:Complete the following steps on the AxoSyslog server: Steps: Create an X.509 certificate for the AxoSyslog … - [Creating core files](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/syslog-ng-core-files/index.md): Purpose:When syslog-ng crashes for some reason, it can create a core file that contains important troubleshooting … - [default-network-drivers: Receive and parse common syslog messages](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-default-network-drivers/index.md): The default-network-drivers() source is a special source that uses multiple source drivers to receive and parse several … - [elasticsearch-http() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch-http/reference-destination-elasticsearch-http/index.md): The elasticsearch-http destination of AxoSyslog can directly post log messages to an Elasticsearch deployment using the … - [Element: ruleset](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-ruleset/index.md): Location/patterndb/ruleset DescriptionA container element to group log patterns for an application or program. A … - [Enabling normal disk-based buffering](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/configuring-diskbuffer-normal/index.md): Every destination driver supports the disk-buffer() option. The network(), syslog(), tcp(), and tcp6() destination … - [Encrypting log messages with TLS](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tls-serverauth/index.md): This section describes how to configure TLS encryption in syslog-ng. For the concepts of using TLS in syslog-ng, see … - [External actions](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/patterndb-triggers-actions/patterndb-actions-external/index.md): To perform an external action when a message is triggered, for example, to send the message in an email, you have to … - [file() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-file/reference-source-file/index.md): The file() driver has the following options: chain-hostnames() Accepted values: yes, no Default: no Description: Enable … - [filter()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-filter/index.md): Synopsis: filter(filtername) Description: Call another filter rule and evaluate its value. For example: filter … - [Getting the status information of disk-buffer files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/get-information-about-disk-buffer-files/get-information-about-disk-buffer-files-getting-status-info/index.md): This section describes how to get status information of the disk-buffer files used in AxoSyslog. Command syntaxThe … - [Global options reference](https://axoflow.com/docs/axosyslog-core/chapter-global-options/reference-options/index.md): The following options can be specified in the options statement, as described in Configuring global options. … - [Install AxoSyslog with Helm](https://axoflow.com/docs/axosyslog-core/install/helm/index.md): AxoSyslog provides Helm charts for syslog-ng. You can use these charts to install cloud-ready syslog-ng images created … - [How AxoSyslog interacts with Apache Kafka](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka/destination-kafka-interaction/index.md): When stopping the AxoSyslog application, AxoSyslog will not stop until all Java threads are finished, including the … - [How AxoSyslog interacts with Elasticsearch](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch2/destination-elasticsearch2-interaction/index.md): The AxoSyslog application sends the log messages to the official Elasticsearch client library, which forwards the data … - [How AxoSyslog interacts with HDFS](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-hdfs/destination-hdfs-interaction/index.md): The AxoSyslog application sends the log messages to the official HDFS client library, which forwards the data to the … - [How pattern matching works](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/concepts-pattern-databases/syslog-ng-patterndb-operation/index.md): The followings describe how patterns work. This information applies to program patterns and message patterns alike, … - [HTTP destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/reference-destination-http-nonjava/index.md): The http destination of AxoSyslog can directly post log messages to web services using the HTTP protocol. The http … - [IETF-syslog messages](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-message-structure/concepts-message-ietfsyslog/index.md): This section describes the format of a syslog message, according to the IETF-syslog protocol. A syslog message consists … - [if-else-elif: Conditional expressions](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/logpath/concepts-if-else-conditional-expressions/index.md): You can use if {}, elif {}, and else {} blocks to configure conditional expressions. Note that if {} blocks imply the … - [Limitations to using the mqtt() destination](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-mqtt-intro/destination-mqtt-lim/index.md): Using the mqtt() destination of AxoSyslog has the following limitations: You can only use the mqtt() destination with … - [Limitations to using the mqtt() source](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-mqtt/source-mqtt-lim/index.md): Using the mqtt() source of AxoSyslog has the following limitations: You can only use the mqtt() source with AxoSyslog … - [Listing configuration options](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/modules/list-configuration-options/index.md): Starting with AxoSyslog 3.25, you can use the syslog-ng-cfg-db.py utility to list the available options of … - [Logging with AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-logging-with-syslog-ng/index.md): The AxoSyslog application reads incoming messages and forwards them to the selected destinations. The AxoSyslog … - [Looking up GeoIP data from IP addresses (DEPRECATED)](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/geoip-parser/index.md): This parser is deprecated. Use Looking up GeoIP2 data from IP addresses instead. The AxoSyslog application can lookup … - [Managing incoming and outgoing messages with flow-control](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-flow-control/index.md): This section describes the internal message-processing model of syslog-ng, as well as the flow-control feature that can … - [Metrics reference](https://axoflow.com/docs/axosyslog-core/chapter-log-statistics/metrics-reference/index.md): The following list shows the metrics available in AxoSyslog. AxoSyslog provides detailed metrics about its performance … - [Modify messages using rewrite rules](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/index.md): The AxoSyslog application can rewrite parts of the messages using rewrite rules. Rewrite rules are global objects … - [mongodb() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-mongodb/reference-destination-mongodb/index.md): The mongodb() driver sends messages to a MongoDB database. MongoDB is a schema-free, document-oriented database. The … - [MsSQL-specific interaction methods](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-sql/sql-interactions-syslog-ng/mssql-specific-interaction-methods/index.md): In SQL Server 2005 this restriction is lifted - kind of. The total length of all key columns in an index cannot exceed … - [opensearch() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-opensearch/reference-destination-opensearch/index.md): The opensearch destination of AxoSyslog can directly post log messages to an OpenSearch deployment using the OpenSearch … - [Optimizing regular expressions](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/regular-expressions/optimizing-regular-expressions/index.md): The host(), match(), and program() filter functions and some other objects accept regular expressions as parameters. … - [Options of grouping-by parsers](https://axoflow.com/docs/axosyslog-core/chapter-correlating-log-messages/grouping-by-parser/grouping-by-parser-options/index.md): The grouping-by has the following options. aggregate() Synopsis: aggregate() Description: Specifies the message that … - [Options of the XML parsers](https://axoflow.com/docs/axosyslog-core/chapter-parsers/xml-parser/xml-parser-options/index.md): The XML parser has the following options. drop-invalid Synopsis: drop-invalid() Format: yes or no Default: no … - [PAN-OS parser options](https://axoflow.com/docs/axosyslog-core/chapter-parsers/panos-parser/panos-parser-options/index.md): The panos-parser() has the following options: prefix() Synopsis: prefix() Default: “.panos.” Description: Insert a … - [Install AxoSyslog with Podman](https://axoflow.com/docs/axosyslog-core/install/podman/index.md): AxoSyslog provides cloud-ready images. These images differ from the upstream syslog-ng images, because: They’re based … - [Proxy Protocol support](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-network/proxy-prot-intro/index.md): If you connect load balancers to your AxoSyslog application, AxoSyslog identifies every connection that is connected to … - [Proxy Protocol: configuration and output examples](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-network/proxy-prot-intro/proxy-prot-conf/index.md): This section provides information about enabling Proxy Protocol support in your network() source options, and an … - [python() and python-fetcher() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/python-source/reference-source-python/index.md): The python() and python-fetcher() drivers have the following options. chain-hostnames() Accepted values: yes, no … - [redis() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-redis/reference-destination-redis/index.md): The redis() driver sends messages as name-value pairs to a Redis key-value store. The redis() destination has the … - [Relay mode](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-modes-of-operation/concepts-relay-mode/index.md): In relay mode, AxoSyslog receives logs through the network from AxoSyslog clients and forwards them to the central … - [Reusing configuration blocks](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/large-configs/config-blocks/index.md): To create a reusable configuration snippet and reuse parts of a configuration file, you have to define the block (for … - [Set message fields to specific values](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set/index.md): To set a field of the message to a specific value, you have to: define the string to include in the message, and select … - [Shell-style globbing in the selector](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/data-enrichment-add-contextual-data/add-contextual-data-globs/index.md): Starting with in AxoSyslog 3.24 and later, you can use shell-style globbing (’*’ and ‘?’ wildcards) in the selector. To … - [snmp() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-snmp/reference-destination-snmp/index.md): This driver sends SNMP traps using the SNMP v2c or v3 protocol. The snmp() destination has the following options: … - [sumologic-syslog()](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-sumologic-intro/destination-sumologic-syslog/index.md): The sumologic-http() and sumologic-syslog() destinations send log messages to Sumo Logic, a cloud-based log management … - [sumologic-syslog() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-sumologic-intro/destination-sumologic-options/destination-sumologic-options-syslog/index.md): The sumologic-syslog() destination supports all network() destination options. In addition, the sumologic-syslog() … - [Templates and macros](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/configuring-macros/index.md): The AxoSyslog application allows you to define message templates, and reference them from every object that can use a … - [The configuration syntax in detail](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/configuration-syntax/index.md): Every syslog-ng.conf configuration file must begin with a line containing version information. For syslog-ng version … - [The syslog-ng-ctl manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/syslog-ng-ctl.1/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [unix-stream() and unix-dgram() source options](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-unixstream/reference-source-unixstream/index.md): These two drivers behave similarly: they open an AF_UNIX socket and start listening on it for messages. The following … - [Using name resolution in syslog-ng](https://axoflow.com/docs/axosyslog-core/chapter-examples/examples-dns/index.md): The AxoSyslog application can resolve the hostnames of the clients and include them in the log messages. However, the … - [Using pattern databases](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/configuring-pattern-databases/index.md): To classify messages using a pattern database, include a db-parser() statement in your syslog-ng.conf configuration … - [Using the GeoIP2 parser](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/geoip2-parser/using-the-geoip2-parser/index.md): Declaration: parser parser_name { geoip2( <macro-containing-the-IP-address-to-lookup> prefix() … - [Using the sql() driver with a Microsoft SQL database](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-sql/configuring-sql-mssql/index.md): The mssql database driver can access Microsoft SQL (MSSQL) destinations. This driver has some special aspects that are … - [value-pairs()](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-value-pairs/option-value-pairs/index.md): Type: parameter list of the value-pairs() option Default: empty string Description: The value-pairs() option allows you … - [What's new in the pattern database format V5](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/what-is-new-patterndb-v5/index.md): The V5 database format has the following differences compared to the V4 format: The <ruleset> element can now store … - [Comma-separated values](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/csv/index.md): The parse_csv FilterX function can separate parts of log messages (that is, the contents of the ${MESSAGE} macro) along … - [Install AxoSyslog with Docker](https://axoflow.com/docs/axosyslog-core/install/docker/index.md): AxoSyslog provides cloud-ready images. These images differ from the upstream syslog-ng images, because: They’re based … - [Parsing messages with comma-separated and similar values](https://axoflow.com/docs/axosyslog-core/chapter-parsers/csv-parser/index.md): The AxoSyslog application can separate parts of log messages (that is, the contents of the ${MESSAGE} macro) at … - [Actions and message correlation](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/patterndb-triggers-actions/patterndb-actions-correlation/index.md): Certain features of generating messages can be used only if message correlation is used as well. For details on … - [Artificial ignorance](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/concepts-pattern-databases/concepts-artificial-ignorance/index.md): Artificial ignorance is a method used to detect anomalies. When applied to log analysis, it means that you ignore the … - [Client modes](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch2/destination-elasticsearch2-client-modes/index.md): The AxoSyslog application can interact with Elasticsearch in the following modes of operation: http, https, node, … - [Collecting debugging information with strace, truss, or tusc](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/syslog-ng-strace-truss-tusc/index.md): To properly troubleshoot certain situations, it can be useful to trace which system calls AxoSyslog performs. How this … - [Comparing macro values in filters](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/filters-comparing/index.md): In AxoSyslog you can compare macro values and templates as numerical and string values. String comparison is … - [Comparing values in FilterX](https://axoflow.com/docs/axosyslog-core/filterx/filterx-comparing/index.md): In AxoSyslog you can compare macro values, templates, and variables as numerical and string values. String comparison … - [Configuring AxoSyslog relays](https://axoflow.com/docs/axosyslog-core/quickstart/relaying-log-messages/index.md): This section describes how to configure AxoSyslog as a relay. - [Correlating log messages using pattern databases](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/configuring-pattern-databases/patterndb-correlation/index.md): The AxoSyslog application can correlate log messages identified using pattern databases. Alternatively, you can also … - [Date-related macros](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/date-macros/index.md): The macros related to the date of the message (for example: ${ISODATE}, ${HOUR}, and so on) have three further variants … - [discord: Send alerts and notifications to Discord](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-discord/index.md): The discord() destination driver sends messages to Discord using Discord Webhook. For the list of available optional … - [Element: patterns](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-patterns/index.md): Location/patterndb/ruleset/patterns DescriptionA container element. A <patterns> element may contain any number of … - [Enterprise-wide message model (EWMM)](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-message-structure/syslog-ng-message-format/index.md): The following section describes the structure of log messages using the Enterprise-wide message model or EWMM message … - [Flow control and the Kafka client](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka-c/destination-kafka-c-flowcontrol/index.md): A AxoSyslog destination recognizes a message as sent when the message has been sent to the Kafka client, not when the … - [Generating configuration blocks from a script](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/large-configs/generating-configuration-blocks/index.md): Purpose:The AxoSyslog application can automatically execute scripts when it is started, and can include the output of … - [Getting the list of disk-buffer files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/get-information-about-disk-buffer-files/get-information-about-disk-buffer-files-getting-list/index.md): PurposeThis section describes getting the list of disk-buffer files used in AxoSyslog. The AxoSyslog application stores … - [host()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-host/index.md): Synopsis: host(regexp) Description: Match messages by using a regular expression against the hostname field of log … - [How to get information about disk-buffer files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/get-information-about-disk-buffer-files/index.md): PurposeThis section describes how to get information about disk-buffer files used in AxoSyslog. Note While reading this … - [Install AxoSyslog](https://axoflow.com/docs/axosyslog-core/install/index.md): This chapter explains how to install AxoSyslog on various platforms. Cloud-ready syslog-ng images AxoSyslog provides … - [Interacting with the database](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-sql/sql-interactions-syslog-ng/index.md): SQL operationsCreate table: If the given table does not exist, AxoSyslog tries to create it with the given column … - [internal: Collect internal messages](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-internal/index.md): All messages generated internally by AxoSyslog use the internal() source. To collect warnings, errors and notices from … - [Junctions and channels](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/logpath/junctions/index.md): Junctions make it possible to send the messages to different channels, process the messages differently on each … - [Kafka destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka/reference-destination-kafka/index.md): The kafka destination of AxoSyslog can directly publish log messages to the Apache Kafka message bus, where subscribers … - [Looking up GeoIP2 data from IP addresses](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/geoip2-parser/index.md): The AxoSyslog application can lookup IP addresses from an offline GeoIP2 database, and make the retrieved data … - [Modes of operation](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-modes-of-operation/index.md): The AxoSyslog application has three typical operation scenarios: Client, Server, and Relay. - [Mutual authentication using TLS](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tls-mutualauth/index.md): This section describes how to configure mutual authentication between the AxoSyslog server and the client. Configuring … - [Notes about the configuration syntax](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/configuration-syntax-notes/index.md): When you are editing the syslog-ng.conf configuration file, note the following points: The configuration file can … - [Optimizing multithreaded performance](https://axoflow.com/docs/axosyslog-core/chapter-multithreading/optimize-syslog-ng-performance/index.md): Destinations that have a queue process that queue in a single thread. Multiple sources can send messages to the same … - [Options add-contextual-data()](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/data-enrichment-add-contextual-data/reference-add-contextual-data-options/index.md): The add-contextual-data() has the following options. Required options:The following options are required: selector(), … - [Options of the mqtt() destination](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-mqtt-intro/destination-mqtt-options/index.md): The mqtt() destination has the following options. Required options: address(), fallback-topic(), and topic(). address() … - [Options of the mqtt() source](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-mqtt/source-mqtt-options/index.md): The mqtt() source has the following options. Required options: address() and topic(). address() Type: string Default: … - [Parsing dates and timestamps](https://axoflow.com/docs/axosyslog-core/chapter-parsers/date-parser/index.md): The date parser can extract dates from non-syslog messages. It operates by default on the ${MESSAGE} part of the log … - [Regular expressions](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/regular-expressions/index.md): Filters and substitution rewrite rules can use regular expressions. In regular expressions, the characters … - [Server mode](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-modes-of-operation/concepts-server-mode/index.md): In server mode, AxoSyslog acts as a central log-collecting server. It receives messages from AxoSyslog clients and … - [Set the severity field](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-severity/index.md): It is possible to configure the severity field with the set-severity() rewrite function. When configured, the … - [Storing messages with MapR-FS](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-hdfs/destination-hdfs-maprfs/index.md): The AxoSyslog application is also compatible with MapR File System (MapR-FS). MapR-FS provides better performance, … - [sumologic-http() and sumologic-syslog() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-sumologic-intro/destination-sumologic-options/index.md): The sumologic-http() and sumologic-syslog() destinations have the following options. - [The Azure auth header plugin](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/plugin-azure-auth-header/index.md): This section describes the AxoSyslog application’s Azure auth header plugin. For more information about modules in … - [The pattern database format](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/index.md): Pattern databases are XML files that contain rules describing the message patterns. The following scheme describes the … - [Transferring your logs to Elasticsearch using GeoIP2](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/geoip2-parser/transferring-your-logs-to-elasticsearch-using-geoip2/index.md): If you are transferring your log messages into Elasticsearch, use the following rewrite rule to combine the longitude … - [Triggering actions for identified messages](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/patterndb-triggers-actions/index.md): The AxoSyslog application can generate (trigger) messages automatically if certain events occur, for example, a … - [Using disk-based and memory buffering](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/index.md): The AxoSyslog application can store messages on the local hard disk if the destination (for example, the central log … - [Visualize the configuration](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/modules/visualize-configuration/index.md): Starting with AxoSyslog 3.25, you can visualize the configuration of a running AxoSyslog instance using the … - [Conditional statements](https://axoflow.com/docs/axosyslog-core/filterx/filterx-conditional/index.md): A conditional statement ( if (expr) { ... } elif (expr) {} else { ... };) allows you to evaluate complex decision trees. … - [String search in FilterX](https://axoflow.com/docs/axosyslog-core/filterx/filterx-string-search/index.md): Available in AxoSyslog 4.9 and later. You can check if a string contains a specified string using the includes FilterX … - [Collecting logs from chroot](https://axoflow.com/docs/axosyslog-core/chapter-examples/example-chroot/index.md): Purpose:To collect logs from a chroot using an AxoSyslog client running on the host, complete the following steps: - [db-parser: Process message content with a pattern database (patterndb)](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/index.md): - [Sending Kubernetes logs to OpenSearch](https://axoflow.com/docs/axosyslog-core/quickstart/opensearch-helm/index.md): The following tutorial shows you how to install AxoSyslog on Kubernetes, deploy OpenSearch to the same cluster, and … - [Configuring log rotation](https://axoflow.com/docs/axosyslog-core/chapter-examples/example-logrotate/index.md): The AxoSyslog application does not rotate logs by itself. To use AxoSyslog for log rotation, consider the following … - [Creating pattern databases](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/index.md): - [Defining configuration objects inline](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/inline-objects/index.md): Starting with AxoSyslog 3.4, you can define configuration objects inline, where they are actually used, without having … - [elasticsearch2: DEPRECATED - Send messages directly to Elasticsearch version 2.0 or higher](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch2/index.md): Warning This destination is deprecated and will be removed from a future version of AxoSyslog. We recommend using the … - [Element: rules](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-rules/index.md): Location/patterndb/ruleset/rules DescriptionA container element for the rules of the ruleset. AttributesN/A Children … - [Enabling memory buffering](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/configuring-diskbuffer-memory/index.md): To enable memory buffering, use the log-fifo-size() parameter in the destination. All destination drivers can use … - [file: Collect messages from text files](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-file/index.md): Collects log messages from plain-text files, for example, from the logfiles of an Apache webserver. If you want to use … - [Filters](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/index.md): The following sections describe how to select and filter log messages. Using filters describes how to configure and use … - [Global objects](https://axoflow.com/docs/axosyslog-core/chapter-concepts/msgroute/index.md): The AxoSyslog application uses the following objects: Source driver: A communication method used to receive log … - [Hard versus soft macros](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/macros-hard-vs-soft/index.md): Hard macros contain data that is directly derived from the log message, for example, the ${MONTH} macro derives its … - [in-list()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-inlist/index.md): Synopsis: in-list("</path/to/file.list>", value("")) Description: Matches the value of the specified field to a list … - [Kerberos authentication with the hdfs() destination](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-hdfs/destination-hdfs-kerberos-authentication/index.md): Version 3.10 and later supports Kerberos authentication to authenticate the connection to your Hadoop cluster. … - [Log path flags](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/logpath/reference-logflags/index.md): Flags influence the behavior of syslog-ng, and the way it processes messages. The following flags may be used in the … - [Managing and checking the syslog-ng service on Linux](https://axoflow.com/docs/axosyslog-core/quickstart/managing-and-checking-linux/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [Options of geoip2 parsers](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/geoip2-parser/geoip2-parser-options/index.md): The geoip2 parser has the following options. prefix() Synopsis: prefix() Description: Insert a prefix before the name … - [Options of the kafka() destination's C implementation](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka-c/reference-destination-kafka-c/index.md): The C implementation of the kafka() destination of AxoSyslog can directly publish log messages to the Apache Kafka … - [Parsing enterprise-wide message model (EWMM) messages](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-ewmm/index.md): The ewmm-parser() can be used to parse messages sent by another AxoSyslog host using the enterprise-wide message model … - [Password-protected keys](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tls-password-protected-keys/index.md): Starting with AxoSyslog version 3.14, you can use password-protected private keys in the network() and syslog() source … - [Possible error messages you may encounter while using the mqtt() destination](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-mqtt-intro/destination-mqtt-error/index.md): While using the mqtt() destination, you may encounter issues and corresponding error messages originating from the MQTT … - [Printing the content of disk-buffer files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/get-information-about-disk-buffer-files/get-information-about-disk-buffer-files-printing-content/index.md): PurposeThis section describes printing the content of the disk-buffer files used in AxoSyslog. Command syntaxThe … - [Running a failure script](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/syslog-ng-failure-script/index.md): Purpose:You can create a failure script that is executed when AxoSyslog terminates abnormally, that is, when it exits … - [Search Guard](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch2/syslog-ng-elasticsearch2-search-guard/index.md): Purpose:Version 3.9 and later supports the Search Guard Elasticsearch plugin (version 2.4.1.16 and newer) to encrypt … - [Set the facility field](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-facility/index.md): It is possible to set the facility field with the set-facility() rewrite function. When set, the set-facility() rewrite … - [sql() destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-sql/reference-destination-sql/index.md): This driver sends messages into an SQL database. The sql() destination has the following options: batch-bytes() … - [The PRI message part](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-message-structure/concepts-message-pri/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [The Python HTTP header plugin](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/plugin-python-http-header/index.md): This section describes the AxoSyslog application’s Python HTTP header plugin. For more information about modules in … - [Using wildcards, special characters, and regular expressions in filters](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/regular-expr/index.md): The host(), match(), and program() filter functions accept regular expressions as parameters. The exact type of the … - [Fortigate parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-fortigate/index.md): The Fortigate parser can parse the log messages of FortiGate/FortiOS (Fortigate Next-Generation Firewall (NGFW)). These … - [Load balancing logs between multiple destinations](https://axoflow.com/docs/axosyslog-core/chapter-examples/load-bal-multi-dest/index.md): These sections describe a method of load balancing logs between multiple AxoSyslog destinations. The first subsection … - [Parsing data in FilterX](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/index.md): - [Send messages to Elasticsearch data streams](https://axoflow.com/docs/axosyslog-core/chapter-destinations/elasticsearch-data-stream/index.md): Starting with version 4.8.0, AxoSyslog can send messages and metrics to Elasticsearch data streams to store your log … - [group-lines parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-group-lines/index.md): Available in AxoSyslog version 4.2 and newer. The group-lines() parser correlates multi-line messages received as … - [About disk queue files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/about-disk-buffer-files/index.md): Normal and reliable queue filesThe key difference between disk queue files that employ the reliable(yes) option and not … - [elasticsearch-http: Send messages to Elasticsearch HTTP Bulk API](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch-http/index.md): Version 3.21 of AxoSyslog can directly post log messages to an Elasticsearch deployment using the Elasticsearch Bulk … - [Elasticsearch2 destination options (DEPRECATED)](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-elasticsearch2/reference-destination-elasticsearch2/index.md): Warning This destination is deprecated and will be removed from a future version of AxoSyslog. We recommend using the … - [Element: rule](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-rule/index.md): Location/patterndb/ruleset/rules/rule DescriptionAn element containing message patterns and how a message that matches … - [HDFS destination options](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-hdfs/reference-destination-hdfs/index.md): The hdfs destination stores the log messages in files on the Hadoop Distributed File System (HDFS). The hdfs … - [iptables parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-iptables/index.md): The iptables parser can parse the log messages of the iptables command. Available in version 3.16 and later. FilterX … - [level() or priority()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-priority/index.md): Synopsis: level() or level(..) Description: The level() filter selects messages corresponding to a single importance … - [Macros of AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/reference-macros/index.md): The following macros are available in AxoSyslog templates. Warning These macros are available when AxoSyslog … - [Handle OpenTelemetry log records](https://axoflow.com/docs/axosyslog-core/filterx/filterx-otel/index.md): AxoSyslog allows you to process, manipulate, and create OpenTelemetry log messages using FilterX. For example, you can: … - [Orphan disk-buffer files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/get-information-about-disk-buffer-files/get-information-about-disk-buffer-files-orphan/index.md): PurposeThis section describes orphan disk-buffer files used in AxoSyslog. Orphan disk-buffer files In certain … - [Handle SDATA in RFC5424 log records](https://axoflow.com/docs/axosyslog-core/filterx/filterx-sdata/index.md): Available in AxoSyslog 4.9 and later. AxoSyslog FilterX has a few functions to handle the structured data (SDATA) part … - [Set the priority of a message](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-pri/index.md): You can set the PRI value of a BSD or IETF syslog message with the set-pri() rewrite function by specifying a template … - [Stopping the syslog-ng process](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/syslog-ng-stop/index.md): To avoid problems, always use the init scripts to stop syslog-ng (/etc/init.d/syslog-ng stop), instead of using the … - [Supported platforms](https://axoflow.com/docs/axosyslog-core/intro/supported-platforms/index.md): The AxoSyslog application supports x86_64 and ARM architechtures on Linux and macOS operating systems. To run the … - [Tagging messages](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/tagging-messages/index.md): You can label the messages with custom tags. Tags are simple labels, identified by their names, which must be unique. … - [Timezones and daylight saving](https://axoflow.com/docs/axosyslog-core/chapter-concepts/timezone-handling/index.md): The AxoSyslog application receives the timezone and daylight saving information from the operating system it is … - [TLS options](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/tlsoptions/index.md): This page describes the TLS-related options of the network() and syslog() drivers. Where applicable, other drivers also … - [Using channels in configuration objects](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/embedded-objects/index.md): Starting with AxoSyslog 3.4, every configuration object is a log expression. Every configuration object is essentially … - [wildcard-file: Collect messages from multiple text files](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-wildcard-file/index.md): The wildcard-file() source collects log messages from multiple plain-text files from multiple directories. The … - [Dropping messages](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/example-dropping-messages/index.md): To skip the processing of a message without sending it to a destination, create a log statement with the appropriate … - [JSON parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/json-parser/index.md): JavaScript Object Notation (JSON) is a text-based open standard designed for human-readable data interchange. It is … - [Metrics](https://axoflow.com/docs/axosyslog-core/filterx/filterx-metrics/index.md): Available in AxoSyslog 4.9 and later. You can use the update_metric function to count the processed messages, and … - [Statistics reference](https://axoflow.com/docs/axosyslog-core/chapter-log-statistics/log-statistics-description/index.md): Statistics are a legacy way to access the status of AxoSyslog. Metrics are newer and in active development. Many … - [Update filters to FilterX](https://axoflow.com/docs/axosyslog-core/filterx/update-filters/index.md): The following sections show you how you can change your existing filters and rewrite rules to FilterX statements. Note … - [Element: patterns](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-patterns2/index.md): Location/patterndb/ruleset/rules/rule/patterns DescriptionAn element containing the patterns of the rule. If a element … - [file: Store messages in plain-text files](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-file/index.md): The file driver is one of the most important destination drivers. It allows to output messages to the specified text … - [Filter functions](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/index.md): The following functions may be used in the filter statement, as described in Filters. Filter functions available in … - [Global and environmental variables](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/config-global-variables/index.md): You can define global variables in the configuration file. Global variables are actually name-value pairs. When … - [key=value pairs](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/key-value-parser/index.md): The parse_kv FilterX function can split a string consisting of whitespace or comma-separated key=value pairs (for … - [LEEF](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/leef/index.md): Available in AxoSyslog 4.9 and later. The parse_leef FilterX function parses messages formatted in the Log Event … - [match()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-match/index.md): Synopsis: match(regexp), match(regexp value("MACRO")), match(regexp template("MACROS")) Description: Match a regular … - [Parsing key=value pairs](https://axoflow.com/docs/axosyslog-core/chapter-parsers/key-value-parser/index.md): The AxoSyslog application can separate a message consisting of whitespace or comma-separated key=value pairs (for … - [Process orphan disk-buffer files](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/concepts-diskbuffer/get-information-about-disk-buffer-files/diskb-proc-sep-sysl-inst/index.md): PurposeWhen AxoSyslog creates orphan disk-buffer files, you can start a separate AxoSyslog instance parallel to the … - [Product licensing](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-licensing/index.md): Versions 4.12 and newerStarting with version 4.12, AxoSyslog is licensed under a single, clear open source license: GNU … - [Reporting bugs and finding help](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/report-bugs/index.md): If you need help, want to open a support ticket, or report a bug, we recommend using the syslog-ng-debun tool to … - [Set match variables](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-matches/index.md): Match macros ($1, $2, ... $255) are temporary variables. You can use them for general purposes when operating with … - [The concepts of AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-concepts/index.md): This chapter discusses the technical concepts of AxoSyslog. - [Using template functions](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/template-functions/index.md): A template function is a transformation: it modifies the way macros or name-value pairs are expanded. Template … - [Windows Event Log](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/windows-eventlog/index.md): Available in AxoSyslog 4.9 and later. The parse_windows_eventlog_xml() FilterX function parses Windows Event Logs XMLs. … - [Linux audit parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/linux-audit-parser/index.md): The Linux audit parser can parse the log messages of the Linux Audit subsystem (auditd). The AxoSyslog application can … - [Configuration identifier](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/configuration-identifier/index.md): Starting with AxoSyslog version 4.2, you can specify a configuration identifier in the syslog-ng.conf file, for … - [Google Pub/Sub gRPC](https://axoflow.com/docs/axosyslog-core/chapter-destinations/google-pubsub-grpc/index.md): Starting with version 4.10.0, AxoSyslog can send data to Google Cloud Pub/Sub using its gRPC interface. Prerequisites A … - [Google Pub/Sub HTTP REST API](https://axoflow.com/docs/axosyslog-core/chapter-destinations/google-pubsub/index.md): Starting with version 4.5.0, AxoSyslog can send data to Google Cloud Pub/Sub using its HTTP REST API. Prerequisites A … - [Hypr Audit Trail and Hypr App Audit Trail](https://axoflow.com/docs/axosyslog-core/chapter-sources/hypr-audit-trail/index.md): Starting with version 4.2.0, AxoSyslog can fetch events from the Hypr REST API using the hypr-audit-trail() and … - [Jellyfin logs](https://axoflow.com/docs/axosyslog-core/chapter-sources/jellyfin/index.md): Starting with version 4.7.0, you can use the jellyfin() source to read Jellyfin logs from its log file output. Example … - [Element: urls](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-url/index.md): Location/patterndb/ruleset/rules/rule/patterns/urls DescriptionOPTIONAL — An element containing one or more URLs … - [graphite: Send metrics to Graphite](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-graphite/index.md): The graphite() destination can send metrics to a Graphite server to store numeric time-series data. There are many ways … - [High availability support](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-high-availability/index.md): Multiple AxoSyslog servers can be run in fail-over mode. The AxoSyslog application does not include any internal … - [linux-audit: Collect messages from Linux audit logs](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-linux-audit/index.md): It reads and automatically parses the Linux audit logs. You can override the file name using the filename() parameter … - [MariaDB parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-mariadb-audit/index.md): The MariaDB parser can parse the log messages of the MariaDB Audit Plugin. The parser supports the syslog output … - [message()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-message/index.md): Synopsis: message(regexp) Description: Match a regular expression to the text of the log message, excluding the headers … - [Recover data from orphaned diskbuffer files](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/diskbuffer-recovery/index.md): When you change the configuration of a AxoSyslog host that uses disk-based buffering (also called disk queue), … - [Template functions of AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/reference-template-functions/index.md): The following template functions are available in AxoSyslog. base64-encodeSyntax: $(base64-encode argument) … - [Unset message fields](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-unset/index.md): You can unset macros or fields of the message, including any user-defined macros created using parsers (for details, … - [Using modules](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/modules/index.md): To increase its flexibility and simplify the development of additional modules, the AxoSyslog application is modular. … - [XML](https://axoflow.com/docs/axosyslog-core/filterx/filterx-parsing/xml/index.md): Available in AxoSyslog 4.9 and later. The parse_xml() FilterX function parses raw XMLs into dictionaries. This is a new … - [kubernetes: Collect and parse the Kubernetes CRI (Container Runtime Interface) format](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-kubernetes/index.md): The kubernetes() source collects container logs managed by the Kubelet. It reads plain-text and JSON-formatted … - [mbox: Convert local email messages to log messages](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-source-mbox/index.md): Using the mbox() driver, AxoSyslog can read email messages from local mbox files, and convert them to multiline log … - [metrics-probe](https://axoflow.com/docs/axosyslog-core/chapter-parsers/metrics-probe/index.md): Available in AxoSyslog version 4.1.1 and newer. metrics-probe() is a special parser that counts the messages that pass … - [Element: values](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-values/index.md): Location/patterndb/ruleset/rules/rule/patterns/values DescriptionOPTIONAL — Name-value pairs that are assigned to … - [graylog2: Send logs to Graylog](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-graylog/index.md): graylog2(): Sending logs to GraylogYou can use the graylog2() destination and a Graylog Extended Log Format (GELF) … - [Managing complex configurations](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/large-configs/index.md): The following sections describe some methods that can be useful to simplify the management of large-scale AxoSyslog … - [Modifying the on-the-wire message format](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/customizing-message-format/on-the-wire-format/index.md): Macros, templates, and template functions allow you to fully customize the format of the message. This flexibility … - [mqtt: receiving messages from an MQTT broker](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-mqtt/index.md): From AxoSyslog version 3.35, you can use the mqtt() source to fetch messages from MQTT brokers. The mqtt() source … - [netmask()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-netmask/index.md): Synopsis: netmask(ipv4/mask) Description: Select only messages sent by a host whose IP address belongs to the specified … - [Netskope parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-netskope/index.md): The Netskope parser can parse Netskope log messages. These messages do not completely comply with the syslog RFCs, … - [Rename message fields](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-rename/index.md): If you want to change the name of a field of a message, you can use rename() rewrite rules. This can be also achieved … - [The structure of a log message](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-message-structure/index.md): The following sections describe the structure of log messages. Currently there are two standard syslog message formats: … - [Parse OpenTelemetry messages](https://axoflow.com/docs/axosyslog-core/chapter-parsers/opentelemetry/index.md): By default, AxoSyslog doesn’t parse the fields of incoming OpenTelemetry messages into name-value pairs, but are only … - [panos-parser(): parsing PAN-OS log messages](https://axoflow.com/docs/axosyslog-core/chapter-parsers/panos-parser/index.md): The PAN-OS (a short version of Palo Alto Networks Operating System) parser can parse log messages originating from Palo … - [PostgreSQL csvlog](https://axoflow.com/docs/axosyslog-core/chapter-parsers/postgresql-csvlog-parser/index.md): Available in AxoSyslog version 4.5.0 and later. This parser processes messages in the PostgreSQL csvlog format. The … - [Create custom SDATA fields](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/custom-sdata-fields/index.md): If you use RFC5424-formatted (IETF-syslog) messages, you can also create custom fields in the SDATA part of the message … - [hdfs: Store messages on the Hadoop Distributed File System (HDFS)](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-hdfs/index.md): Starting with version 3.7, AxoSyslog can send plain-text log files to the Hadoop Distributed File System (HDFS), … - [Message representation in AxoSylog](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-message-representation/index.md): When the AxoSyslog application receives a message, it automatically parses the message. The AxoSyslog application can … - [netmask6()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-netmask6/index.md): Synopsis: netmask6(ipv6/mask) Description: Select only messages sent by a host whose IP address belongs to the … - [network: Collect messages using the RFC3164 protocol (network() driver)](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-network/index.md): The network() source driver can receive syslog messages conforming to RFC3164 from the network using the TCP, TLS, and … - [Python code in external files](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/python-code-external-file/index.md): You can extend and customize AxoSyslog easily by writing destinations, parsers, template functions, and sources in … - [Python parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/python-parser/index.md): The Python log parser (available in AxoSyslog version 3.10 and later) allows you to write your own parser in Python. … - [The configuration file](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/index.md): - [Regular expression (regexp) parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-regexp/index.md): The AxoSyslog application can parse fields from a message with the help of regular expressions. This can be also … - [Structured data (SDATA) parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/sdata-parser/index.md): Available in AxoSyslog 4.1 and later. The sdata-parser() allows you to parse an RFC5424-style structured data string. … - [Error messages](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/error-messages/index.md): This section describes the most common error messages. Destination queue full Error message: Destination queue full, … - [java: Post messages over HTTP using Java](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http/index.md): Version 3.7 of AxoSyslog can directly post log messages to web services using the HTTP protocol. Error and status … - [Logging from your Python code](https://axoflow.com/docs/axosyslog-core/chapter-configuration-file/python-code-logging/index.md): You can extend and customize AxoSyslog easily by writing destinations, parsers, template functions, and sources in … - [nodejs: Receive JSON messages from nodejs applications](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-source-nodejs/index.md): Using the nodejs() driver, AxoSyslog can receive application logs directly from nodejs applications that use the … - [program()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-program/index.md): Synopsis: program(regexp) Description: Match messages by using a regular expression against the program name field of … - [Set multiple message fields to specific values](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-groupset/index.md): The groupset() rewrite rule allows you to modify the value of multiple message fields at once, for example, to change … - [source: Read, receive, and collect log messages](https://axoflow.com/docs/axosyslog-core/chapter-sources/index.md): - [Structuring macros, metadata, and other value-pairs](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-value-pairs/index.md): Available in AxoSyslog 3.3 and later. The AxoSyslog application allows you to select and construct name-value pairs … - [Sudo parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-sudo/index.md): The sudo parser can parse the log messages of the sudo command. Available in version 3.16 and later. Declaration: … - [Log statistics from the internal() source](https://axoflow.com/docs/axosyslog-core/chapter-log-statistics/log-statistics-internal-source/index.md): Note Instead of using the statistics messages of the internal() source, we recommend monitoring AxoSyslog using … - [FilterX operator reference](https://axoflow.com/docs/axosyslog-core/filterx/operator-reference/index.md): This page describes the operators you can use in FilterX blocks. Arithmetic operatorsAvailable in AxoSyslog 4.12 and … - [Parsing syslog messages](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-syslog/index.md): By default, AxoSyslog parses every message using the syslog-parser as a syslog message, and fills the macros with … - [Upgrade syslog-ng to AxoSyslog](https://axoflow.com/docs/axosyslog-core/install/upgrade-syslog-ng/index.md): If you’re already using syslog-ng, you can upgrade your existing syslog-ng deployments to AxoSyslog in a matter of … - [Forward Windows logs](https://axoflow.com/docs/axosyslog-core/install/windows/index.md): Axoflow provides a custom OpenTelemetry Collector distribution that you can use to collect logs on Windows hosts and … - [destination: Forward, send, and store log messages](https://axoflow.com/docs/axosyslog-core/chapter-destinations/index.md): A destination is where a log message is sent if the filtering rules match. Similarly to sources, destinations consist … - [Element: actions](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-actions/index.md): Location/patterndb/ruleset/actions DescriptionOPTIONAL — A container element for actions that are performed if a … - [http: Post messages over HTTP without Java](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [map-value-pairs: Rename value-pairs to normalize logs](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/parser-map-value-pairs/index.md): The map-value-pairs() parser allows you to map existing name-value pairs to a different set of name-value pairs. You … - [Parsing tags](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-tags/index.md): The AxoSyslog application can tag log messages, and can include these tags in the log messages, as described in Tagging … - [rate-limit()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-rate-limit/index.md): Synopsis: rate-limit(key($HOST) rate(5000)) Description: Limits messages rate based on arbitrary keys in each message. … - [SELinux prevents using the execmem access on a process](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/troubleshooting-selinux-issue-creating-parsers/index.md): If you are using a recent enough PCRE library, AxoSyslog will automatically use the JIT of the regexp engine, which … - [Things to consider when forwarding messages between AxoSyslog hosts](https://axoflow.com/docs/axosyslog-core/chapter-concepts/concepts-things-to-consider/index.md): When you send your log messages from a AxoSyslog client through the network to a AxoSyslog server, you can use … - [Collect OpenBSD kernel log messages](https://axoflow.com/docs/axosyslog-core/chapter-sources/openbsd/index.md): The openbsd() source driver collects kernel log messages on OpenBSD systems. The driver reads messages from the … - [Websense parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/parser-websense/index.md): The Websense parser can parse the log messages of Websense Content Gateway (Raytheon|Websense, now Forcepoint). These … - [Windows XML Event Log (EVTX) parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/windows-eventlog-xml-parser/index.md): Available in AxoSyslog version 4.5 and later. The new windows-eventlog-xml-parser() can parse messages in the Windows … - [Conditional rewrites](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/conditional-rewrite/index.md): Starting with 3.2, it is possible to apply a rewrite rule to a message only if certain conditions are met. The … - [Element: action](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-action/index.md): Location/patterndb/ruleset/actions/action DescriptionOPTIONAL — A container element describing an action that is … - [kafka: Publish messages to Apache Kafka (Java implementation)](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka/index.md): Starting with version 3.7, AxoSyslog can directly publish log messages to the Apache Kafka message bus, where … - [log: Filter and route log messages using log paths, flags, and filters](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/index.md): - [Receive logs, metrics, and traces from OpenTelemetry](https://axoflow.com/docs/axosyslog-core/chapter-sources/opentelemetry/index.md): Starting with version 4.3.0, AxoSyslog can receive logs, metrics, and traces from OpenTelemetry clients over the … - [source()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-source/index.md): Synopsis: source id Description: Select messages of a source statement. This filter can be used in embedded log … - [XML parser](https://axoflow.com/docs/axosyslog-core/chapter-parsers/xml-parser/index.md): Extensible Markup Language (XML) is a text-based open standard designed for both human-readable and machine-readable … - [osquery: Collect and parse osquery result logs](https://axoflow.com/docs/axosyslog-core/chapter-sources/syslog-ng-source-osquery/index.md): The osquery application allows you to ask questions about your machine using an SQL-like language. For example, you can … - [Add and delete tags](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-tags/index.md): To add or delete a tag, you can use rewrite rules. To add a tag, use the following syntax: rewrite <name_of_the_rule> { … - [Element: create-context](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-create-context/index.md): Location/patterndb/ruleset/actions/action/create-context DescriptionOPTIONAL — Creates a new correlation context from … - [FilterX function reference](https://axoflow.com/docs/axosyslog-core/filterx/function-reference/index.md): This page describes the functions you can use in FilterX blocks. Functions have arguments that can be either mandatory … - [Global options](https://axoflow.com/docs/axosyslog-core/chapter-global-options/index.md): - [kafka-c(): Publish messages to Apache Kafka (C implementation)](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-kafka-c/index.md): Starting with version 3.21, AxoSyslog can directly publish log messages to the Apache Kafka message bus, where … - [pacct: Collect process accounting logs on Linux](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-pacct/index.md): Starting with version 3.2, AxoSyslog can collect process accounting logs on Linux systems.Process accounting is the … - [tags()](https://axoflow.com/docs/axosyslog-core/chapter-routing-filters/filters/reference-filters/filter-tags/index.md): Synopsis: tag Description: Select messages labeled with the specified tag. Every message automatically has the tag of … - [Pi-hole Faster Than Light logs](https://axoflow.com/docs/axosyslog-core/chapter-sources/pihole-ftl/index.md): Starting with version 4.6.0, AxoSyslog can collect logs of the Pi-hole FTL (Faster Than Light) application. source … - [Element: tags](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-tags/index.md): Location/patterndb/ruleset/tags DescriptionOPTIONAL — An element containing custom keywords (tags) about the messages … - [loggly: Send logs to Loggly](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-loggly/index.md): The loggly() destination sends log messages to the Loggly Logging-as-a-Service provider. You can send log messages over … - [pipe: Collect messages from named pipes](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-pipe/index.md): The pipe driver opens a named pipe with the specified name and listens for messages. It is used as the native message … - [Rewrite the timezone of a message](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-timezone/index.md): Starting with version 3.24 of the AxoSyslog application, you can manipulate the timezone information of messages using … - [TLS-encrypted message transfer](https://axoflow.com/docs/axosyslog-core/chapter-encrypted-transport-tls/index.md): - [Anonymize credit card numbers](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/anonymizing-credit-card-numbers/index.md): Log messages of banking and e-commerce applications might include credit card numbers (Primary Account Number or PAN). … - [logmatic: Send logs to Logmatic.io](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-logmatic/index.md): The logmatic() destination sends log messages to the Logmatic.io Logging-as-a-Service provider. You can send log … - [program: Receive messages from external applications](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-program/index.md): The program driver starts an external application and reads messages from the standard output (stdout) of the … - [template and rewrite: Format, modify, and manipulate log messages](https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/index.md): This chapter explains the methods that you can use to customize, reformat, and modify log messages using AxoSyslog. … - [Send messages to Falcon LogScale](https://axoflow.com/docs/axosyslog-core/chapter-destinations/crowdstrike-falcon/index.md): Starting with version 4.3.0, AxoSyslog can send messages to Falcon LogScale using its Ingest Structured Data API. That … - [Reuse FilterX blocks](https://axoflow.com/docs/axosyslog-core/filterx/reuse-filterx-block/index.md): To use a FilterX block in multiple log paths, you have to define it as a separate block: block filterx <identifier>() { … - [Handle and fix timezones and timestamps](https://axoflow.com/docs/axosyslog-core/filterx/filterx-timezone/index.md): AxoSyslog FilterX has a few functions set or fix the timestamp and timezone of the messages. fix_timezoneAvailable in … - [loki: Grafana Loki](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-loki/index.md): Available in AxoSyslog version 4.4 and later. The loki() destination sends your log data to Grafana Loki. Note that: … - [IP addresses and subnets](https://axoflow.com/docs/axosyslog-core/filterx/filterx-subnet/index.md): Available in AxoSyslog 4.25 and later. FilterX has two types to work with network addresses: ip() represents a single … - [mongodb(): Store messages in a MongoDB database](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-mongodb/index.md): The mongodb() driver sends messages to a MongoDB database. MongoDB is a schema-free, document-oriented database. For … - [parser: Parse and segment structured messages](https://axoflow.com/docs/axosyslog-core/chapter-parsers/index.md): The filters and default macros of AxoSyslog work well on the headers and metainformation of the log messages, but are … - [python: writing server-style Python sources](https://axoflow.com/docs/axosyslog-core/chapter-sources/python-source/index.md): The Python source allows you to write your own source in Python. You can import external Python modules to receive or … - [Troubleshooting](https://axoflow.com/docs/axosyslog-core/filterx/filterx-troubleshooting/index.md): To help troubleshooting FilterX blocks, AxoSyslog includes some specific functions that allow you to track failures in … - [Correlating log messages](https://axoflow.com/docs/axosyslog-core/chapter-correlating-log-messages/index.md): The AxoSyslog application can correlate log messages. Alternatively, you can also correlate log messages using pattern … - [mqtt(): Send messages from a local network to an MQTT broker](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-mqtt-intro/index.md): From version 3.33, you can use the mqtt() destination to publish messages to MQTT brokers. The mqtt() destination … - [python-fetcher: writing fetcher-style Python sources](https://axoflow.com/docs/axosyslog-core/chapter-sources/python-fetcher-source/index.md): The Python source allows you to write your own source in Python. You can import external Python modules to receive or … - [qBittorrent logs](https://axoflow.com/docs/axosyslog-core/chapter-sources/qbittorrent/index.md): Starting with version 4.6.0, AxoSyslog can collect logs of the qBittorrent application. source s_qbittorrent { … - [Enriching log messages with external data](https://axoflow.com/docs/axosyslog-core/chapter-enrich-data/index.md): To properly interpret the events that the log messages describe, you must be able to handle log messages as part of a … - [network: Send messages to a remote log server using the RFC3164 protocol (network() driver)](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-network/index.md): The network() destination driver can send syslog messages conforming to RFC3164 from the network using the TCP, TLS, … - [snmptrap: Read Net-SNMP traps](https://axoflow.com/docs/axosyslog-core/chapter-sources/syslog-ng-source-snmptrap/index.md): Using the snmptrap() source, you can read and parse the SNMP traps of the Net-SNMP’s snmptrapd application. AxoSyslog … - [Send messages to OpenObserve](https://axoflow.com/docs/axosyslog-core/chapter-destinations/openobserve/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [opensearch: Send messages to OpenSearch](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-opensearch/index.md): Available in AxoSyslog version 4.4 and later. The opensearch() destination can directly post log messages to OpenSearch … - [osquery: Send log messages to osquery's syslog table](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-osquery/index.md): The osquery() driver sends log messages to osquery’s syslog table. The syslog table contains logs forwarded over a … - [Statistics and metrics of AxoSyslog](https://axoflow.com/docs/axosyslog-core/chapter-log-statistics/index.md): The AxoSyslog application collects various statistics and metrics about its performance and status for observability … - [sun-streams: Collect messages on Sun Solaris](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-sunstreams/index.md): Solaris uses its STREAMS framework to send messages to the syslogd process. Solaris 2.5.1 and above uses an IPC called … - [Send logs, metrics, and traces to OpenTelemetry](https://axoflow.com/docs/axosyslog-core/chapter-destinations/opentelemetry/index.md): Starting with version 4.3.0, AxoSyslog can send logs, metrics, and traces to OpenTelemetry over the OpenTelemetry … - [Multithreading and scaling](https://axoflow.com/docs/axosyslog-core/chapter-multithreading/index.md): Starting with version 3.3, AxoSyslog can process sources and destinations in multithreaded mode to scale to multiple … - [pipe: Send messages to named pipes](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-pipe/index.md): The pipe() driver sends messages to a named pipe like /dev/xconsole. The pipe driver has a single required parameter, … - [syslog: Collect messages using the IETF-syslog protocol](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-syslog/index.md): The syslog() driver can receive messages from the network using the standard IETF-syslog protocol (as described in … - [axosyslog-otlp(): Receive logs from another node using OpenTelemetry](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-syslog-ng-otlp/index.md): Available in AxoSyslog version 4.12 and later. (From version 4.4 to 4.11, this driver was called syslog-ng-otlp().) The … - [Nonsequential message processing](https://axoflow.com/docs/axosyslog-core/chapter-nonsequential-processing/index.md): By default, AxoSyslog processes log messages arriving from a single connection sequentially. Sequential processing: … - [program: Send messages to external applications](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-program/index.md): The program() driver starts an external application or script and sends the log messages to its standard input (stdin). … - [system: Collect the system-specific log messages of a platform](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-system/index.md): Starting with version 3.2, AxoSyslog can automatically collect the system-specific log messages of the host on a number … - [pseudofile()](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-pseudofile/index.md): The pseudofile() destination driver is a very simple driver, aimed at delivering messages to special files such as … - [systemd-journal: Collect messages from the systemd-journal system log storage](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-journal/index.md): The systemd-journal() source is used on various Linux distributions, such as RHEL (from RHEL7) and CentOS. The … - [Writing Python modules](https://axoflow.com/docs/axosyslog-core/writing-python-modules/index.md): AxoSyslog has comprehensive support for implementing various logging components in Python. This chapter shows you how … - [Best practices and examples](https://axoflow.com/docs/axosyslog-core/chapter-examples/index.md): This chapter discusses some special examples and recommendations. - [python: Write custom Python destinations](https://axoflow.com/docs/axosyslog-core/chapter-destinations/python-destination/index.md): The Python destination allows you to write your own destination in Python. You can import external Python modules to … - [systemd-syslog: Collect systemd messages using a socket](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-systemd-syslog/index.md): On platforms running systemd, the systemd-syslog() driver reads the log messages of systemd using the … - [Troubleshooting](https://axoflow.com/docs/axosyslog-core/chapter-troubleshooting-syslog-ng/index.md): This chapter provides tips and guidelines about troubleshooting problems related to syslog-ng. As a general rule, first … - [redis: Store name-value pairs in Redis](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-redis/index.md): The redis() driver sends messages as name-value pairs to a Redis key-value store. For the list of available parameters, … - [tcp, tcp6, udp, udp6: OBSOLETE - Collect messages from remote hosts using the BSD syslog protocol](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-tcpudp/index.md): Note The tcp(), tcp6(), udp(), and udp6() drivers are obsolete. Use the network() source and the network() destination … - [FilterX](https://axoflow.com/docs/axosyslog-core/filterx/index.md): Note FilterX (developed by Axoflow) is a replacement for syslog-ng filters, parsers, and rewrite rules. It has its own … - [Getting support](https://axoflow.com/docs/axosyslog-core/support/index.md): In case you need help with any of the AxoSyslog projects, or directly with syslog-ng, you have several ways to contact … - [Format data](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/index.md): AxoSyslog FilterX has several functions to format data into specific formats. - [Manual pages](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/index.md): - [riemann: Monitor your data with Riemann](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-riemann/index.md): The riemann() driver sends your data (for example, metrics or events) to a Riemann monitoring system. For the list of … - [The dqtool tool manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/dqtool.1/index.md): Namedqtool — Display the contents of a disk-buffer file created with AxoSyslog. Synopsisdqtool [command] [options] … - [The loggen manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/loggen.1/index.md): Nameloggen — Generate syslog messages at a specified rate Note: If you don’t have AxoSyslog installed and want to run … - [The pdbtool manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/pdbtool.1/index.md): Namepdbtool — An application to test and convert pattern database rules Synopsispdbtool [command] [options] … - [The persist-tool manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/persist-tool.1/index.md): Namepersist-tool — Display the content of the persist file Synopsispersist-tool [command] [options] DescriptionThe … - [The secure-logging manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/secure-logging.7/index.md): Namesecure-logging — Forward integrity and confidentiality for system logs. Synopsis$(slog --key-file &lt;host key … - [The slogencrypt manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/slogencrypt.1/index.md): Nameslogencrypt — Encrypt existing plain text log files using the AxoSyslog secure logging environment. … - [The slogkey manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/slogkey.1/index.md): Nameslogkey — Manage cryptographic keys for use with the AxoSyslog secure logging environment. Synopsisslogkey … - [The slogverify manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/slogverify.1/index.md): Nameslogverify — Verify cryptographically secured logs. Synopsisslogverify [options] [arguments] DescriptionThe … - [The syslog-debun manual page](https://axoflow.com/docs/axosyslog-core/app-man-syslog-ng/syslog-ng-debun.1/index.md): Namesyslog-debun — syslog-ng DEBUg buNdle generator Synopsissyslog-debun [options] Description Note The syslog-debun … - [The syslog-ng OSE Documentation License](https://axoflow.com/docs/axosyslog-core/documentation-license/index.md): Permission is hereby granted, free of charge, to any person obtaining a copy of these documentation files (the … - [unix-stream, unix-dgram: Collect messages from UNIX domain sockets](https://axoflow.com/docs/axosyslog-core/chapter-sources/source-unixstream/index.md): The unix-stream() and unix-dgram() drivers open an AF_UNIX socket and start listening on it for messages. On Linux both … - [s3: Amazon S3](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-s3/index.md): Available in AxoSyslog version 4.4 and later. The s3() destination sends log messages to the Amazon Simple Storage … - [slack: Send alerts and notifications to a Slack channel](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-slack/index.md): The slack() destination driver sends messages to a Slack channel using the Slack Web API. For the list of available … - [stdin: Collect messages from the standard input stream](https://axoflow.com/docs/axosyslog-core/chapter-sources/configuring-sources-stdin/index.md): The stdin() driver collects messages from the standard input stream. When the standard input stream is closed, … - [smtp: Generate SMTP messages (emails) from logs](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-smtp/index.md): The destination is aimed at a fully controlled local, or near-local, trusted SMTP server. The goal is to send mail to … - [snmp: Send SNMP traps](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-snmp/index.md): The snmp() driver sends SNMP traps using the Simple Network Management Protocol version 2c or version 3. Incoming log … - [splunk-hec-event: Send messages to Splunk HEC](https://axoflow.com/docs/axosyslog-core/chapter-destinations/syslog-ng-with-splunk/index.md): Starting with version 4.2.0, AxoSyslog can send messages to the Splunk HTTP Event Collector (HEC). Prerequisites Enable … - [sql: Store messages in an SQL database](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-sql/index.md): The sql() driver sends messages into an SQL database. Currently the Microsoft SQL (MSSQL), MySQL, Oracle, PostgreSQL, … - [Webhook](https://axoflow.com/docs/axosyslog-core/chapter-sources/webhook/index.md): Starting with version 4.8.0, AxoSyslog can collect logs via a webhook using the webhook() and webhook-json() sources. … - [stdout: Send messages to standard output](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-stdout/index.md): Available in AxoSyslog version 4.4 and later. The stdout() destination driver sends messages to the standard output. … - [stomp: Publish messages using STOMP](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-stomp/index.md): The stomp() driver sends messages to servers (message brokers) using the Simple (or Streaming) Text Oriented Message … - [Sumo Logic destinations: sumologic-http() and sumologic-syslog()](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-sumologic-intro/index.md): From version 3.27.1, the AxoSyslog application can send log messages to Sumo Logic, a cloud-based log management and … - [syslog: Send messages to a remote logserver using the IETF-syslog protocol](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-syslog/index.md): The syslog() driver sends messages to a remote host (for example, a syslog-ng server or relay) on the local intranet or … - [syslog-ng(): Forward logs to another syslog-ng node](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-syslog-ng/index.md): The syslog-ng() destination driver forwards log messages to another AxoSyslog node in EWMM format. Note: For similar … - [axosyslog-otlp(): Forward logs to another node using OpenTelemetry](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-syslog-ng-otlp/index.md): Available in AxoSyslog version 4.12 and later. (From version 4.4 to 4.11, this driver was called syslog-ng-otlp().) The … - [tcp, tcp6, udp, udp6: OBSOLETE - Send messages to a remote log server using the legacy BSD-syslog protocol (tcp(), udp() drivers)](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-tcpudp/index.md): Note The tcp(), tcp6(), udp(), and udp6() drivers are obsolete. Use the network() source and the network() destination … - [telegram: Send messages to Telegram](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-telegram/index.md): The telegram() destination sends log messages to Telegram, which is a secure, cloud-based mobile and desktop messaging … - [unix-stream, unix-dgram: Send messages to UNIX domain sockets](https://axoflow.com/docs/axosyslog-core/chapter-destinations/configuring-destinations-unixstream/index.md): The unix-stream() and unix-dgram() drivers send messages to a UNIX domain socket in either SOCK_STREAM or SOCK_DGRAM … - [usertty: Send messages to a user terminal](https://axoflow.com/docs/axosyslog-core/chapter-destinations/destination-usertty/index.md): This driver writes messages to the terminal of a logged-in user. The usertty() driver has a single required argument, … - [Write your own custom destination in Java or Python](https://axoflow.com/docs/axosyslog-core/chapter-destinations/reference-destination-custom/index.md): The AxoSyslog application is open source, so if you have the necessary programming skills, you can extend it if its … - [Client-side failover](https://axoflow.com/docs/axosyslog-core/chapter-destinations/concepts-failover/index.md): AxoSyslog can detect if the remote server of a network destination becomes inaccessible, and start sending messages to … - [A note on timezones and timestamps](https://axoflow.com/docs/axosyslog-core/chapter-concepts/timezone-handling/example-timezones/index.md): If the clients run syslog-ng, then use the ISO timestamp, because it includes timezone information. That way you do not … - [AxoSyslog documentation](https://axoflow.com/docs/axosyslog-core/index.md): New to AxoSyslog? AxoSyslog is a binary compatible syslog-ng replacement, from the original creator, developed by the … - [Categories](https://axoflow.com/docs/axosyslog-core/categories/index.md): - [Comma-separated values](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-csv/index.md): Formats a dictionary or a list into a comma-separated string. Usage: format_csv(<input-list-or-dict>, … - [Common Event Format (CEF)](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-cef/index.md): Available in AxoSyslog 4.13 and later. Formats a dictionary into the Common Event Format (CEF). Usage: ${MESSAGE} = … - [Element: example](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-example/index.md): Location/patterndb/ruleset/rules/rule/patterns/examples/example DescriptionOPTIONAL — A container element for a sample … - [Element: examples](https://axoflow.com/docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-examples/index.md): Location/patterndb/ruleset/rules/rule/patterns/examples DescriptionOPTIONAL — A container element for sample log … - [How relaying log messages works](https://axoflow.com/docs/axosyslog-core/quickstart/relaying-log-messages/example-how-relaying-works/index.md): Depending on your exact needs about relaying log messages, there are many scenarios and AxoSyslog options that … - [JSON](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-json/index.md): Formats any value into a raw JSON string. Usage: format_json($data) - [Key-value pairs](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-kv/index.md): Formats a dictionary into a string containing key=value pairs. Usage: format_kv(kvs_dict, … - [Log Event Extended Format (LEEF)](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-leef/index.md): Available in AxoSyslog 4.13 and later. Formats a dictionary into the Log Event Extended Format (LEEF). Both LEEF … - [Resolving hostnames locally](https://axoflow.com/docs/axosyslog-core/chapter-examples/examples-dns/example-local-dns/index.md): Purpose:Resolving hostnames locally enables you to display hostnames in the log files for frequently used hosts, … - [RFC5424 syslog](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-rfc5424/index.md): Available in AxoSyslog 4.21 and later. Formats data as an RFC5424 (IETF-syslog) syslog message. Usage: … - [Search this site](https://axoflow.com/docs/axosyslog-core/search/index.md): - [Tags](https://axoflow.com/docs/axosyslog-core/tags/index.md): - [Windows Event Logs XML](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-windows-eventlog-xml/index.md): Available in AxoSyslog 4.13 and later. Formats a dictionary into Windows Event Logs XML. It’s a specialized version of … - [XML](https://axoflow.com/docs/axosyslog-core/filterx/filterx-format-data/format-xml/index.md): Available in AxoSyslog 4.13 and later. Formats a dictionary into XML. To format data as Windows Event Log XML, see …