Syslog-ng

Syslog-ng is commonly used for host, network, appliance, and security logs. If those events already flow through syslog-ng, you can add an HTTP destination and send structured JSON records to Parseable.

Prerequisites

You need syslog-ng with the HTTP destination available, a Parseable ingest endpoint, an API key, and a dataset name. The example below uses syslog-ng-logs.

Configure Syslog-ng

Add a Parseable destination to your syslog-ng configuration. This example formats the event as JSON and forwards it to Parseable.

destination d_parseable {
  http(
    url("http://<parseable-ingestor-endpoint>:8000/api/v1/ingest")
    method("POST")
    headers(
      "Content-Type: application/json"
      "X-API-Key: <parseable-api-key>"
      "X-P-Stream: syslog-ng-logs"
    )
    body("$(format-json --scope rfc5424 --scope nv-pairs)")
  );
};

log {
  source(s_src);
  destination(d_parseable);
};

Use your existing source block if it already listens for UDP, TCP, TLS, or local system logs. The important part is that the destination sends JSON to /api/v1/ingest with the API key and stream headers.

Verify Logs

Reload syslog-ng and send a test syslog message through the configured source. In Parseable, open syslog-ng-logs and check that the event contains fields such as host, facility, priority, program, and message.

If you do not see events, check syslog-ng logs for HTTP destination errors and confirm that your firewall allows syslog-ng to reach the Parseable ingest endpoint.