What's new

This page is a changelog that collects the major changes and additions to this documentation. (If you want to know the details about why we have separate documentation for AxoSyslog and how it relates to the syslog-ng documentation, read our syslog-ng documentation and similarities with AxoSyslog Core blog post.)

Version 4.11 (2025-04-09)

Documentation for the Webhook.
New macros: PEERIP and PEERPORT
New gRPC option response-action() for the bigquery(), clickhouse(), google-pubsub-grpc(), loki(), and the opentelemetry() destinations.
New FilterX functions: set_pri, set_timestamp.
Updates the Azure Monitor destination.

Version 4.10 (2025-02-13)

New Google Pub/Sub gRPC destination to send logs and data to Google Pub/Sub via gRPC.
New destination to send logs and data to Azure Monitor and Microsoft Sentinel. For details, see Send data to Azure Monitor and Sentinel.
New $SOURCEPORT macro which expands to the source port of the peer.
The syslog() source driver can now auto-detect RFC6587-style octet-count based framing.
Lots of FilterX updates, including a new =?? operator and several functions:
- keys
- load_vars
- metrics_labels
- set_fields
- strftime
Switch-case expressions in FilterX to better organize the code instead of using multiple if, elif, else blocks. Using switch-case expressions also improves performance.

Version 4.9 (2024-11-11)

ClickHouse database destination.
Log tapping with the syslog-ng-ctl attach command.
FilterX data parsing and processing engine.
Updated lists of available options for the gRPC-based destinations (bigquery(), loki(), opentelemetry(), syslog-ng-otlp()). You can now also set dynamic header values for these destinations.
Added the idle-timeout() option to file() source options, stdin() source options, systemd-syslog() source options, wildcard-file() source options, pipe() source options, program() source options, unix-stream() and unix-dgram() source options.

These sources have a new exit-on-eof flag that makes AxoSyslog stop when EOF is received.
Added the MSGFORMAT macro.
Added .tls.x509_fp to .tls.x509.

Version 4.8 (2024-07-12)

APT repository for Debian and Ubuntu based systems.
You can send messages and metrics to Elasticsearch data streams to store your log and metrics data as time series data using the elasticsearch-datastream() destination driver.
You can use the server-side-encryption() and kms-key() options to configure encryption for Amazon S3 destinations.
You can now set static gRPC headers in the bigquery(), loki(), and the opentelemetry() destinations.
The opentelemetry() parser has a new set-hostname() option.

Version 4.7 (2024-04-18)

Arr logs source
Jellyfin logs source
channel-args() option for gRPC-based drivers, like opentelemetry()
concurrent-requests() option for the opentelemetry() source and the syslog-ng-otlp() source
tenant-id() option for the Loki destination
tags-head template function
MQTT_TOPIC macro
TRANSPORT macro updates