Initial commit

syslog-ng.conf

@@ -0,0 +1,30 @@
+@version: 4.2
+
+# Source to receive logs from remote syslog clients (UDP & TCP).
+#   We use `network()` over `syslog()` here as `syslog()` alone handles
+#   framing differently which will result in errors and missing data.
+# network(transport(tcp) port(514) flags(syslog-protocol));
+source s_sys {
+    syslog(transport(udp) port(514));
+    network(transport(tcp) port(601) flags(syslog-protocol));
+};
+
+# Source to read local logs.
+source s_local {
+    internal();
+};
+
+# Log destination to forward to Alloy.
+# Change "syslog.example.com" to host IP running Alloy and
+# adjust syslog port as needed based on your Alloy config.
+destination d_alloy {
+  syslog("alloy.example.com" transport("tcp") port(1514));
+};
+
+
+# Ship local log files & received syslog messages to Alloy.
+log {
+  source(s_sys);
+  source(s_local);
+  destination(d_alloy);
+};