datalust/seq-input-syslog repository overview

⁠datalust/seq-input-syslog

Previously datalust/squiflog.

Ingest syslog RFC 5424⁠ and RFC 3164⁠ messages via UDP into Seq⁠.

TCP and TLS not currently supported.

⁠Getting started with Docker

For Docker, the app is deployed as a Docker container that is expected to run alongside the Seq container. The datalust/seq-input-syslog container accepts syslog messages (via UDP on port 514 by default), and forwards them to the Seq ingestion endpoint specified in the SEQ_ADDRESS environment variable.

To run the container:

docker run \
    --name seq-input-syslog \
    -d \
    --restart unless-stopped \
    -p 514:514/udp \
    -e SEQ_ADDRESS=https://seq.example.com:5341 \
    datalust/seq-input-syslog

⁠Container configuration

A seq-input-syslog container can be configured using the following environment variables:

⁠Example Usage: Collecting Docker container logs

The output from any Docker container can be collected by configuring its logging driver on startup:

docker run \
    --name my-app \
    -d \
    --restart unless-stopped \
    --log-driver syslog \
    --log-opt syslog-address=udp://syslog-app.example.com:514 \
    --log-opt syslog-format=rfc5424 \
    my-app:latest

In this case the syslog-address option needs to resolve to the running seq-input-syslog container.

Note, providing the --log-opt syslog-format=rfc5424 enables the stricter and more informative RFC 5424 Syslog format. Leaving this unset may default to the earlier RFC 3164 format.