How to use the Syslog plugin

This plugin ships Kestra execution and audit logs to a Syslog collector or SIEM, formatted as CEF (Common Event Format) messages, over UDP, TCP, or TLS. It is used as a logExporters entry inside LogShipper or AuditLogShipper, not as a standalone task.

Authentication

• host (required) and port (optional, defaults to 514 for UDP/TCP and 6514 for TLS) identify the Syslog collector.
• protocol selects the transport: UDP (fire-and-forget datagrams), TCP (RFC 5425 octet-counting framing over a plain socket), or TLS (same framing over an encrypted socket).
• For TLS, provide trustStorePath (and trustStoreType/trustStorePassword if needed) pointing to a PKCS12/JKS truststore file on the worker's filesystem containing the collector's CA certificate. Store trustStorePassword as a secret.
• If the collector uses a self-signed certificate and you cannot provision a truststore, set skipCertVerification: true. This disables all certificate verification and is unsafe — only use it for testing.
• connectionTimeout (defaults to PT10S) bounds how long establishing the TCP/TLS connection may take, and doubles as the read timeout for the TLS handshake and any protocol-level reads; it does not bound a write blocked on a collector that stopped draining data. Not used for UDP.
• Connection and identity properties can be centralized with plugin defaults across flows.

Tasks

LogExporter

The only class in this plugin. Consumes a stream of Kestra LogRecords from the enclosing shipper task and formats each one as:

<PRI>TIMESTAMP HOSTNAME APP-NAME CEF: 0|Vendor|Product|Version|SignatureId|Name|Severity|Extension

• PRI is computed from facility (default USER) and the record's log level.
• Vendor, Product, Version, APP-NAME, and HOSTNAME are configurable identity fields (deviceVendor, deviceProduct, deviceVersion, appName, hostname), all under the advanced group; hostname defaults to the worker's local hostname.
• SignatureId/Name are derived from the record's taskId/flowId attributes when present.
• Severity (0-10) is mapped from the record's log level (ERROR -> 10 down to TRACE -> 0).
• Extension contains the log message (msg=) followed by the record's remaining attributes as escaped key=value pairs.

Records are buffered in chunk-sized batches (default 1000, bounded 1-10000) and written over a single connection opened once per execution.

Gotchas:

• CEF header fields escape \ and |; extension values escape \, =, and newlines (\n), per the CEF specification.
• UDP has no message framing: an oversized record (over ~65 KB) is skipped with a warning instead of failing the whole batch.
• Connection, handshake, and truststore-loading failures raise an actionable error without ever including the truststore password.