Syslog Inputs

Select this check box to enable the input on all Graylog nodes, or keep it unchecked to enable the input on a specific node.

The hostname or IP address of the message broker (e.g. RabbitMQ server).

The logical namespace within the broker used to separate applications or tenants.

The maximum number of messages a consumer can receive before acknowledging them.

The name of the queue from which messages will be consumed.

The exchange to which the input should bind in order to receive messages.

The key used by the exchange to route messages into the specified queue.

Defines how many consumers or queues should be created for message processing.

Enables message rate limiting to control ingestion speed and prevent system overload.

The port number used by the message broker.

The username for authenticating against the message broker, if required.

The password associated with the broker username for authentication.

Declares the queue in passive mode, ensuring it exists without modifying or creating it.

Binds the input to a specific exchange in the broker to receive messages from it.

Interval (in seconds) for client–broker heartbeat checks to detect lost connections.

Enable secure TLS for encrypted message transport (requires certificates). Select if this input should use TLS.

Determines whether invalid/unprocessable messages are placed back into the queue.

Time interval (in seconds) to wait before retrying a broker connection after failure.

By default, messages parse the source field as the provided hostname in the log message. However, if you want to override this setting for devices that output non-standard or unconfigurable hostnames, you can set an alternate source name here.

All messages need to support the encoding configured for the input. For example, UTF-8 encoded messages should not be sent to an input configured to support UTF-16.

Forces a reverse DNS lookup on incoming messages to resolve the hostname from the IP address.

Permits incoming messages to use their own timestamp instead of the system’s received time.

Keeps the entire raw message in addition to the parsed fields for future reference or troubleshooting.

Expands structured data elements (e.g. key-value pairs in syslog) into individual fields.

Select this check box to enable the input on all Graylog nodes, or keep it unchecked to enable the input on a specific node.

A compatibility setting that allows the input to parse messages formatted according to older syslog standards or non-RFC-compliant message structures.

Enter the IP address and port on which the Kafka server is running.

Minimum byte size a message batch should reach before fetching.

Enter the maximum time (in milliseconds) to wait before fetching.

Enter the number of threads to process. This setting is based on the number of partitions available for the topic.

Permits incoming messages to use their own timestamp instead of the system’s received time.

Choose the appropriate selection from the drop-down menu if there is no initial offset in Kafka or if an offset is out of range.

The name of the consumer group the Kafka input belongs to.

Enter the default hostname derived from the received packet. Only set this source if you want to override it with a custom string.

Default encoding is UTF-8. Set this to a standard charset name if you want to override the default.

Forces a reverse DNS lookup on incoming messages to resolve the hostname from the IP address.

Permits incoming messages to use their own timestamp instead of the system’s received time.

Keeps the entire raw message in addition to the parsed fields for future reference or troubleshooting.

Expands structured data elements (e.g. key-value pairs in Syslog) into individual fields.

Select this check box to enable the input on all Graylog nodes, or keep it unchecked to enable the input on a specific node.

Enter a port to use in conjunction with the IP address.

This setting controls how many concurrent threads are used to process incoming data. Increasing the number of threads can enhance data processing speed, resulting in improved throughput. The ideal number of threads to configure depends on the available CPU cores on your Graylog server. A common starting point is to align the number of worker threads with the number of CPU cores. However, it is crucial to strike a balance with other server demands.

The certificate private key file that is stored on a Graylog system. The value of this field is a path (/path/to/file) that Graylog should have access to, and etc/graylog/tls is recommended. Ensure this path is readable by the user running the Graylog service.

Select this option if this input should use TLS.

The private key password.

If you want to require authentication, set this value to optional or required.

The path where client (source) certificates are located on a Graylog system. The value of this field is a path (/path/to/file) to a file or a directory containing client certificates that Graylog should have access to, etc/graylog/tls (recommended). Ensure this is readable by the user running the Graylog service

Enable this option if you want the input to support TCP keep-alive packets to prevent idle connections.

This option is typically left unchecked, as new line is the delimiter for each message.

The maximum message size of the message. The default value should suffice but can be modified depending on message length. Each input type usually has specifications that note the maximum length of a message.

Enter the default hostname derived from the received packet. Only set this source if you want to override it with a custom string.

Default encoding is UTF-8. Set this to a standard charset name if you want to override the default.

Forces a reverse DNS lookup on incoming messages to resolve the hostname from the IP address.

Keeps the entire raw message in addition to the parsed fields for future reference or troubleshooting.

Expands structured data elements (e.g. key-value pairs in syslog) into individual fields.

Select this check box to enable the input on all Graylog nodes, or keep it unchecked to enable the input on a specific node.

Enter a port to use in conjunction with the IP address.

This setting controls how many concurrent threads are used to process incoming data. Increasing the number of threads can enhance data processing speed, resulting in improved throughput. The ideal number of threads to configure depends on the available CPU cores on your Graylog server. A common starting point is to align the number of worker threads with the number of CPU cores. However, it is crucial to strike a balance with other server demands.

Enter the default hostname derived from the received packet. Only set this source if you want to override it with a custom string.

Default encoding is UTF-8. Set this to a standard charset name if you want to override the default.

Forces a reverse DNS lookup on incoming messages to resolve the hostname from the IP address.

Permits incoming messages to use their own timestamp instead of the system’s received time.

Keeps the entire raw message in addition to the parsed fields for future reference or troubleshooting.

Expands structured data elements (e.g. key-value pairs in syslog) into individual fields.