Collecting, parsing, and forwarding syslog messages

<Extension syslog>
    Module    xm_syslog
</Extension>

<Input system_logs>
    Module    im_file
    File      '/var/log/syslog'
    Exec      parse_syslog(); (1)
</Input>

<Extension syslog>
    Module        xm_syslog
</Extension>

<Input udp_listen>
    Module        im_udp
    ListenAddr    localhost:514 (1)
    Exec          parse_syslog();
</Input>

<Extension syslog>
    Module        xm_syslog
</Extension>

<Input tcp_listen>
    Module        im_tcp
    ListenAddr    0.0.0.0:1514
    Exec          parse_syslog();
</Input>

<Extension syslog>
    Module        xm_syslog
</Extension>

<Input tcp_listen>
    Module        im_tcp
    ListenAddr    0.0.0.0:1514
    InputType     Syslog_TLS (1)
    Exec          parse_syslog_ietf();
</Input>

<Extension syslog>
    Module         xm_syslog
</Extension>

<Input tcp_listen>
    Module         im_ssl
    ListenAddr     0.0.0.0:6514
    CAFile         %CERTDIR%/ca.pem (1)
    CertFile       %CERTDIR%/agent-cert.pem (2)
    CertKeyFile    %CERTDIR%/agent-key.pem (3)
    InputType      Syslog_TLS (4)
    Exec           parse_syslog_ietf();
</Input>

<Extension syslog>
    Module    xm_syslog
</Extension>

<Output syslog_file>
    Module    om_file
    File      '/tmp/syslog-bsd.log' (1)
    Exec      to_syslog_bsd(); (2)
</Output>

<Extension syslog>
    Module    xm_syslog
</Extension>

<Output syslog_file>
    Module    om_file
    File      '/tmp/syslog-bsd-no-pri.log'
    <Exec>
        to_syslog_bsd();
        $raw_event =~ s/^\<\d+\>//; (1)
    </Exec>
</Output>

<Extension syslog>
    Module    xm_syslog
</Extension>

<Output tcp>
    Module    om_tcp
    Host      192.168.1.1:1514 (1)
    Exec      to_syslog_bsd(); (2)
</Output>

<Extension syslog>
    Module         xm_syslog
</Extension>

<Output tcp_tls>
    Module         om_ssl
    Host           192.168.1.1:6514 (1)
    CAFile         %CERTDIR%/ca.pem (2)
    CertFile       %CERTDIR%/agent-cert.pem (3)
    CertKeyFile    %CERTDIR%/agent-key.pem (4)
    OutputType     Syslog_TLS (5)
    Exec           to_syslog_ietf(); (6)
</Output>

<Extension syslog>
    Module    xm_syslog
</Extension>

<Extension json>
    Module    xm_json
</Extension>

<Input ietf_syslog>
    Module    im_file
    File      '/var/log/ietf-syslog'
    Exec      parse_syslog();
</Input>

<Output json_file>
    Module    om_file
    File      '/tmp/syslog-ietf.json'
    Exec      to_json();
</Output>

<Route r>
    Path      ietf_syslog => json_file
</Route>

<13>1 2026-10-09T14:23:10.000000+00:00 myserver - - - [NXLOG@14506 Purpose="test"] This is a test message.

{
  "EventReceivedTime": "2026-10-09T14:23:11.071221+00:00",
  "SourceModuleName": "ietf_syslog",
  "SourceModuleType": "im_file",
  "Hostname": "myserver",
  "SyslogFacilityValue": 1,
  "SyslogFacility": "USER",
  "SyslogSeverityValue": 5,
  "SyslogSeverity": "NOTICE",
  "SeverityValue": 2,
  "Severity": "INFO",
  "EventTime": "2026-10-09T14:23:10.000000+00:00",
  "Purpose": "test",
  "Message": "This is a test message."
}

<Extension syslog>
    Module    xm_syslog
</Extension>

<Extension json>
    Module    xm_json
</Extension>

<Input json_logs>
    Module    im_file
    File      '/var/log/json'
    Exec      parse_json();
</Input>

<Output syslog_file>
    Module    om_file
    File      '/tmp/syslog-ietf.log'
    Exec      to_syslog_ietf();
</Output>

<Route r>
    Path      json_logs => syslog_file
</Route>

{
  "EventTime": "2026-10-09 14:23:10",
  "Hostname": "myserver",
  "Purpose": "test",
  "Message": "This is a test message."
}

<13>1 2026-10-09T14:23:10.000000+00:00 myserver - - - [NXLOG@14506 EventReceivedTime="2026-10-09 14:23:11" SourceModuleName="json_logs" SourceModuleType="im_file" Purpose="test"] This is a test message.

<Extension syslog>
    Module    xm_syslog
</Extension>

<Extension json>
    Module    xm_json
</Extension>

<Input windows_events>
    Module    im_msvistalog (1)
</Input>

<Output udp>
    Module    om_udp
    Host      192.168.1.1:514
    <Exec>
        $Message = to_json(); (2)
        to_syslog_bsd(); (3)
    </Exec>
</Output>

<Route r>
    Path      windows_events => udp
</Route>

<11>Oct  9 14:23:10 WIN-SERVER Microsoft-Windows-Security-Auditing[0x3990]: {"EventTime":"2026-10-09T14:23:10.000000+00:00","Hostname":"WIN-SERVER","Keywords":"9227875636482146304","EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"TaskValue":12544,"OpcodeValue":0,"RecordNumber":456703,"ActivityID":"{A9B5A229-9B0A-0008-7AA2-B5A90A9BDA01}","ExecutionProcessID":1124,"ExecutionThreadID":7052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-3603782361-128455402-3223720292-1002\r\n\tAccount Name:\t\tjdoe\r\n\tAccount Domain:\t\tNXLOG\r\n\tLogon ID:\t\t0x9d84141\r\n\r\nLogon Type:\t\t\t2\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tjdoe\r\n\tAccount Domain:\t\tNXLOG\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xc000006e\r\n\tSub Status:\t\t0xc000006e\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x3990\r\n\tCaller Process Name:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-SERVER\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi\r\n\r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-3603782361-128455402-3223720292-1002","SubjectUserName":"jdoe","SubjectDomainName":"NXLOG","SubjectLogonId":"0x9d84141","TargetUserSid":"S-1-0-0","TargetUserName":"jdoe","TargetDomainName":"NXLOG","Status":"0xc000006e","FailureReason":"%%2313","SubStatus":"0xc000006e","LogonType":"2","LogonProcessName":"Advapi","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-SERVER","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessId":"0x3990","ProcessName":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2026-10-09T14:23:11.427302+00:00","SourceModuleName":"windows_events","SourceModuleType":"im_msvistalog"}