Syslog LogExporter

Syslog LogExporter
Certified
Enterprise Edition
Send execution logs to a Syslog server in CEF format

Formats each log record as a syslog-framed CEF (Common Event Format) message and ships it to a Syslog collector or SIEM over UDP, TCP, or TLS. Records are batched in chunk-sized groups (default 1000); the underlying connection is opened once per execution and reused across the whole batch.

yaml
type: io.kestra.plugin.ee.syslog.LogExporter

Examples

Ship audit logs to a Syslog collector over UDP

yaml
id: audit_log_shipper_udp
namespace: company.team

triggers:
  - id: daily
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "@daily"

tasks:
  - id: audit_log_export
    type: io.kestra.plugin.ee.core.log.AuditLogShipper
    resources:
      - FLOW
      - EXECUTION
    lookbackPeriod: P1D
    offsetKey: syslog-audit-offset
    logExporters:
      - id: syslogExporter
        type: io.kestra.plugin.ee.syslog.LogExporter
        host: siem.company.com
        port: 514
        protocol: UDP

Ship execution logs to a Syslog collector over TCP with TLS

yaml
id: log_shipper_tls
namespace: company.team

triggers:
  - id: daily
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "@daily"

tasks:
  - id: log_export
    type: io.kestra.plugin.ee.core.log.LogShipper
    logLevelFilter: INFO
    lookbackPeriod: P1D
    offsetKey: syslog-log-offset
    logExporters:
      - id: syslogExporter
        type: io.kestra.plugin.ee.syslog.LogExporter
        host: siem.company.com
        port: 6514
        protocol: TLS
        trustStorePath: /etc/kestra/certs/siem-truststore.p12
        trustStorePassword: "{{ secret('SYSLOG_TRUSTSTORE_PASSWORD') }}"

Properties

host *string

Syslog server host

Hostname or IP address of the Syslog collector, e.g. siem.company.com.

id *string

Validation RegExp^[a-zA-Z0-9][a-zA-Z0-9_-]*

Min length1

appName string

Defaultkestra

Application name

Value used for the syslog header APP-NAME field; defaults to kestra.

chunk integerstring

Default1000

Chunk size

Number of log records buffered per network write; must be between 1 and 10000. Defaults to 1000.

connectionTimeout string

DefaultPT10S

Connection timeout

Maximum time to wait when establishing the TCP/TLS connection to the Syslog server, and the read timeout applied afterwards (covers the TLS handshake and any protocol-level reads). A collector that refuses the connection or stalls the handshake fails within this bound; it does not bound a blocked write to a collector that stopped draining data. Not used for UDP, which is fire-and-forget. Must be positive; a non-positive value (e.g. PT0S) falls back to the default. Defaults to PT10S (10 seconds).

deviceProduct string

DefaultKestra

Device product

Value used for the CEF Device Product header field; defaults to Kestra.

deviceVendor string

DefaultKestra

Device vendor

Value used for the CEF Device Vendor header field; defaults to Kestra.

deviceVersion string

Default

Device version

Value used for the CEF Device Version header field; empty by default.

facility string

DefaultUSER

Possible Values

KERNUSERMAILDAEMONAUTHSYSLOGLPRNEWSUUCPCRONAUTHPRIVFTPNTPAUDITALERTCLOCKLOCAL0LOCAL1LOCAL2LOCAL3LOCAL4LOCAL5LOCAL6LOCAL7

Syslog facility

Syslog facility used to compute the message PRI header value, e.g. USER, LOCAL0..LOCAL7, DAEMON. Defaults to USER.

hostname string

Hostname

Value used for the syslog header HOSTNAME field; defaults to the worker's local hostname.

port integerstring

Syslog server port

TCP/UDP port of the Syslog collector; must be between 1 and 65535. Defaults to 514 for UDP and TCP, and 6514 for TLS.

protocol string

DefaultTCP

Possible Values

UDPTCPTLS

Transport protocol

Transport used to deliver syslog messages: UDP (fire-and-forget datagrams), TCP (RFC 5425 octet-counting framing over a plain socket), or TLS (same framing over an encrypted socket). Defaults to TCP.

skipCertVerification booleanstring

Defaultfalse

Skip TLS certificate verification

When true, disables all TLS certificate verification for the Syslog connection. This is unsafe and should only be used for testing against a server with a self-signed certificate that you cannot add to a truststore. Never enable this in production. Defaults to false.

trustStorePassword string

Truststore password

Password protecting the truststore referenced by trustStorePath, if any.

trustStorePath string

Truststore path

Path to a PKCS12/JKS truststore file, readable from the worker's filesystem, containing the CA certificate(s) needed to trust the Syslog server's TLS certificate. Only used when protocol is TLS; falls back to the JVM default trust store when unset.

trustStoreType string

DefaultPKCS12

Truststore type

Type of the truststore file referenced by trustStorePath; defaults to PKCS12.

Metrics

logs counter

Number of log records processed

requests.count counter

Number of syslog messages sent to the collector

requests.duration timer

Duration of the export