diff --git a/pipeline/inputs/syslog.md b/pipeline/inputs/syslog.md index 940f7ea1d..3d397ee57 100644 --- a/pipeline/inputs/syslog.md +++ b/pipeline/inputs/syslog.md @@ -8,17 +8,19 @@ The plugin supports the following configuration parameters: | Key | Description | Default | |:----------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------| -| `Mode` | Defines transport protocol mode: UDP over Unix socket (`unix_udp`), TCP over Unix socket (`unix_tcp`), `tcp`, or `udp` | `unix_udp` | -| `Listen` | If `Mode` is set to `tcp` or `udp`, specify the network interface to bind. | `0.0.0.0` | -| `Port` | If `Mode` is set to `tcp` or `udp`, specify the TCP port to listen for incoming connections. | `5140` | -| `Path` | If `Mode` is set to `unix_tcp` or `unix_udp`, set the absolute path to the Unix socket file. | _none_ | -| `Unix_Perm` | If `Mode` is set to `unix_tcp` or `unix_udp`, set the permission of the Unix socket file. | `0644` | -| `Parser` | Specify an alternative parser for the message. If `Mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog` messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ | -| `Buffer_Chunk_Size` | By default, the buffer to store the incoming `syslog` messages. Doesn't allocate the maximum memory allowed, instead it allocates memory when required. The rounds of allocations are set by `Buffer_Chunk_Size`. There are considerations when using `udp` or `unix_udp` mode. | `32KB` (set in code) | -| `Buffer_Max_Size` | Specify the maximum buffer size to receive a `syslog` message. If not set, the default size is the value of `Buffer_Chunk_Size`. | _none_ | -| `Receive_Buffer_Size` | Specify the maximum socket receive buffer size. If not set, the default value is OS-dependant, but generally too low to accept thousands of syslog messages per second without loss on `udp` or `unix_udp` sockets. For Linux, the value is capped by `sysctl net.core.rmem_max`. | _none_ | -| `Source_Address_Key` | Specify the key where the source address will be injected. | _none_ | -| `Threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` | +| `buffer_chunk_size` | By default, the buffer to store the incoming `syslog` messages. Doesn't allocate the maximum memory allowed, instead it allocates memory when required. The rounds of allocations are set by `buffer_chunk_size`. There are considerations when using `udp` or `unix_udp` mode. | `32KB` (set in code) | +| `buffer_max_size` | Specify the maximum buffer size to receive a `syslog` message. If not set, the default size is the value of `buffer_chunk_size`. | _none_ | +| `format` | Specify the TCP framing format. Set to `octet_counting` for RFC 6587 compliant octet-counting framing, or `newline` for newline-delimited framing. Only applies to TCP modes (`tcp` or `unix_tcp`). | `newline` | +| `listen` | If `mode` is set to `tcp` or `udp`, specify the network interface to bind. | `0.0.0.0` | +| `mode` | Defines transport protocol mode: UDP over Unix socket (`unix_udp`), TCP over Unix socket (`unix_tcp`), `tcp`, or `udp` | `unix_udp` | +| `parser` | Specify an alternative parser for the message. If `mode` is set to `tcp` or `udp` then the default parser is `syslog-rfc5424`. Otherwise, `syslog-rfc3164-local` is used. If your syslog messages have fractional seconds set this parser value to `syslog-rfc5424` instead. | _none_ | +| `path` | If `mode` is set to `unix_tcp` or `unix_udp`, set the absolute path to the Unix socket file. | _none_ | +| `port` | If `mode` is set to `tcp` or `udp`, specify the TCP port to listen for incoming connections. | `5140` | +| `raw_message_key` | Specify the key where the original raw `syslog` message will be preserved. | _none_ | +| `receive_buffer_size` | Specify the maximum socket receive buffer size. If not set, the default value is OS-dependant, but generally too low to accept thousands of syslog messages per second without loss on `udp` or `unix_udp` sockets. For Linux, the value is capped by `sysctl net.core.rmem_max`. | _none_ | +| `source_address_key` | Specify the key where the source address will be injected. | _none_ | +| `threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` | +| `unix_perm` | If `mode` is set to `unix_tcp` or `unix_udp`, set the permission of the Unix socket file. | `0644` | ### Considerations @@ -251,4 +253,4 @@ $OMUxSockSocket /tmp/fluent-bit.sock *.* :omuxsock: ``` -Make sure that the socket file is readable by `rsyslog` by modifying `Unix_Perm` key. +Make sure that the socket file is readable by `rsyslog` by modifying `unix_perm` key.